Regular expression splunk query

Question

I have a line containing

[India,sn_GB] Welcome : { Name:{Customer1},Place:{Mumbai},}

I want to print the entire line after sn_GB] in splunk, which is

Welcome : { Name:{Customer1},Place:{Mumbai},}

I used the below regular expression:

(?<=sn_).*?$

But it prints, along with GB] like GB] Welcome : { Name:{Customer1},Place:{Mumbai},}. In the word sn_GB, sn_ is constant and the rest two letter will vary, like GB, LB, KB, TB as such.

Please help me in correcting the regular expression.

Thanks

Sorry, I missed out, in the word, sn_GB , sn_ is constant and the rest two letter will vary , like GB, LB, KB, TB as such . How should I include sn_(wildcard)] in the regex ?! — Chinchan, Jul 05 '18 at 06:35

Robert Cotterman · Answer 1 · 2018-07-05T06:44:27.913

0

I understand your question now. Country codes are always 2 letters. i'd use

(?<=sn_..\]\ ).*$

but you could use (?<=sn_[A-Z]{0,5}\]\ \s*).*?$

(?<=sn_....).*$

is the simplest, as it will just grab 4 characters after, if it's always 2 letters for country code, and then a closing bracket and a space

edited Jul 05 '18 at 06:44

answered Jul 05 '18 at 06:33

Robert Cotterman

1,913
2
5
15

Thanks Robert. That really works – Chinchan Jul 05 '18 at 06:55

Ashu · Accepted Answer · 2018-07-05T06:44:55.707

0

This will give the correct result in case sn_GB is constant.

(?<=sn_GB).*?$

If GB is not constant you can go for:

(?<=sn_...).*?$

edited Jul 05 '18 at 06:44

answered Jul 05 '18 at 06:33

Ashu

1,704
2
14
23

Hi Ashu, But your answer is printing along with ] . I don't require ] in the print. how to eliminate it. Any suggestions. – Chinchan Jul 05 '18 at 06:43
Add one more dot to it. (?<=sn_...).*?$ – Ashu Jul 05 '18 at 06:45
Yeah that worked :) – Chinchan Jul 05 '18 at 06:48
I have one more question . How to print only Place:{Mumbai} from Welcome : { Name:{Customer1},Place:{Mumbai},} – Chinchan Jul 05 '18 at 06:49
\{(.*?)\} this will give you all the values between { } – Ashu Jul 05 '18 at 06:59
Thanks Ashu :) It works! – Chinchan Jul 05 '18 at 07:18

Regular expression splunk query

2 Answers2