Extract string in square bracket with regex

user_14697290 0
Viewed 102

my logs in splunk like:

[ A=xaxxxxx ] [ B=weea case ] [ C=another example 0 ]

How can I get only the string in square bracket after "="

like so: xaxxxxx ; weea case ; another example 0

my rex is: rex field=_raw "(?<New_Field>\[\sC=(.*?)\s\])"

it extract all, include square bracket [...].

splunk regex
3 Answers

In Splunk, only named capturing groups must be used to extract data into fields. So, the numbered capturing group in your regex does not do anything meaningful for Splunk. You need to use New_Field group around the pattern part you need to extract.

Also, you only matched C, you can match any uppercase letter with [A-Z], or if there are more than one, [A-Z]+.

You can use

\[\s*[A-Z]+=\s*(?<New_Field>.*?)\s*]

See the regex demo. Details:

  • \[ - a [ char
  • \s* - zero or more whitespaces
  • [A-Z]+ - zero or more uppercase ASCII letters
  • = - a = char
  • \s* - zero or more whitespaces
  • (?<New_Field>.*?) - Group "New_Field": any zero or more chars other than line break chars as few as possible
  • \s* - zero or more whitespaces
  • ] - a ] char.
user_38329700

You can move what you don't want to capture outside of the group:

\[\sC=(?<New_Field>[^\][]*)\s]

The pattern matches:

  • \[\sC= match [ whitespace char and =
  • (?<New_Field> Named group New_Field
  • [^\][]* To stay between the square brackets, you can use a negated character class
  • ) Close group
  • \s\] Match a whitespace char and ]

See a regex demo.

To match A, B or C you can use a character class:

\[\s[A-Z]=(?<New_Field>[^\][]*)\s]

See another regex demo.

user_54249880

Here's a simpler way to do it - and one which will return all the matches in a given event into a multivalue field:

index=ndx sourcetype=srctp
| rex field=_raw max_match=0 "\[[^\[=]+\=(?<new_field>[^\]]+)"

Start with skipping the opening bracket, and anything up to an equal sign

Then everything after the equal sign to a closing bracket will be matched

warren_44180
Related