REX Field Extraction Help

TorbinIT — Wed, 23 Aug 2023 13:45:06 GMT

Hello!

I'm working on a Rex Expression for my job, and wanted to ask for some assistance in developing it. I'm supposed to make a rex expression to pull out the "Fixed version" of a piece of software out of a field called "pluginText". Right now the problem is the Rex expression I've made only works half the time.

My Rex expression is currently:

| rex field=pluginText max_match=0 "\s+Fixed version\s+:\s+(?<FixedVersion>.+)"\n

Here are some relevant examples of the sorts of data I'm working with:

<plugin_output>
Path : C:\Program Files\VMware\VMware Tools\VMware VGAuth\libssl-3-x64.dll
Reported version : 3.0.3.0
Fixed version : 3.0.4</plugin_output>

and

<plugin_output>
Path : C:\myPrograms\cygwin64\bin\openssl.exe
Reported version : 1.1.1.4
Fixed version : 1.1.1p

Path : C:\myPrograms\Git\usr\bin\openssl.exe
Reported version : 1.1.1.9
Fixed version : 1.1.1p

Path : C:\myPrograms\Git\mingw64\bin\openssl.exe
Reported version : 1.1.1.9
Fixed version : 1.1.1p
</plugin_output>

The Rex expression I made works perfectly on the second example I've provided, but not the first. I'm guessing it's due to the </plugin_output> on it.

Any advice for how I can tweak it to work for both sorts of data? Attached is a visual aid of the first example, for clarity. Thank you in advance!

Re: REX Field Extraction Help

TorbinIT — Wed, 23 Aug 2023 13:45:40 GMT

Here's a visual aid of the second example, as well!

Re: REX Field Extraction Help

isoutamo — Wed, 23 Aug 2023 13:50:41 GMT

can you change your regex like

"\s+Fixed version\s+:\s+(?<FixedVersion>[^\n\r\<]+)"

See https://regex101.com/r/z4DfqM/1

regex101 is excellent place to try those and also debug if needed.

r. Ismo

Re: REX Field Extraction Help

TorbinIT — Wed, 23 Aug 2023 13:54:54 GMT

This appears to have fixed my problem perfectly! Thank you very much!

topic Re: REX Field Extraction Help in Getting Data In

REX Field Extraction Help

Re: REX Field Extraction Help

Re: REX Field Extraction Help

Re: REX Field Extraction Help