topic Re: Extracting up to a particular string in rex in Splunk Dev

Extracting up to a particular string in rex

harshparikhxlrd — Tue, 14 Jan 2020 17:28:40 GMT

Here's what I have.

Basically, I'm trying to just get rid of the AddiontalInfo1 and AdditionalInfo2.

Here's the rex command I"m using: | rex field=Message "Message=\"(?.*)"

Re: Extracting up to a particular string in rex

richgalloway — Tue, 14 Jan 2020 17:51:53 GMT

Your regex tells Splunk to grab everything in the Message field. All you need to do is tell it to stop when it gets to "AdditionalInfo".

Try | rex field=Message "Message=\"(?<field>.*) Additional".

Re: Extracting up to a particular string in rex

jpolvino — Tue, 14 Jan 2020 18:37:56 GMT

This may work for you:

| makeresults
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\""
| rex field=Message "Message: (?<subMessage>.*?)\" Additional"

Re: Extracting up to a particular string in rex

TISKAR — Wed, 15 Jan 2020 16:31:56 GMT

Hi:

CAN YOU TRY THIS PLEASE:

| makeresults
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\""
| rex field=Message "Message: (?<Message>.*?)\" AdditionalInfo"

Re: Extracting up to a particular string in rex

jgbricker — Wed, 15 Jan 2020 17:22:39 GMT

If you know you will consistently see the pattern
"Message: message is here which can include punctuation and random quotes AdditionalInfo1" then my approach would be to match on and extract what you know will always precede (Message: whitespace) and then what will be after what you want (AdditionalInfo1) to terminate the regex. Then simply extract everything between. You may need to just leave the field=Message off the rex command because that field's bounds may not be accurate.

I like regex101.com for testing the regex matching

Default for rex is to go against field=_raw so you don't need to specify field=Message

I would specify it only if I knew that what i wanted to extract was always inside that field with no exceptions. The specificity of the rex field is mainly for performance as it limits scope. Your example event is pretty small so probably not a big deal to do _raw.

Between the <> you can all the newly extracted field whatever
Ignore the \'s between <>, this was how I got it to display the field name in answers
You might be able to drop the escaping of : and =

|rex "Message:\s(?<\msg_detail>(.*))AdditionalInfo1="

Re: Extracting up to a particular string in rex

to4kawa — Wed, 15 Jan 2020 17:29:47 GMT

| makeresults 
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\"" 
| eval Message=mvindex(split(Message,"\""),0)

No, REGEX. ( ＾∀＾)

Re: Extracting up to a particular string in rex

harshparikhxlrd — Wed, 15 Jan 2020 21:48:21 GMT

This was my issue. I also found that my other issue I had was a result of using the . operator.

| rex field=Message "Message=\"(?<msg>[\s\S]*)\" AdditionalInfo1"

The dot operator doesn't consider spaces, which was causing an issue in my data. Thank you though.