topic Re: How to escape the end bracket using rex? in Splunk Search

How to escape the end bracket using rex?

rbdev — Wed, 20 Jun 2018 13:43:26 GMT

I've read the threads on escaping the parens and the such. But I'm trying to do the "]". I thought I would be able to just swap the ")" for "]" in the rex command but it doesn't work.

Line: ....[Status: 4] [myfield2: myvalue2][myfield3:myvalue3] [myfield4:myvalue4]

So I've tried the following to extract field2 as value2. The closest one I get is the first and second one. I get the field to extract, but it doesn't cut off on the "]" after it (so the values look like: myvalue2][myfield3:myvalue3] [myfield4:myvalue4])

rex field=_raw "myfield2: (?<myextractvalue2>.*)\\]"

rex field=_raw "myfield2: (?<myextractvalue2>.*)\]"

rex field=_raw "myfield2: (?<myextractvalue2>\w)\\]"

Any help would be greatly appreciated. Thanks.

Re: How to escape the end bracket using rex?

cpetterborg — Wed, 20 Jun 2018 13:56:47 GMT

Try:

rex field=_raw "myfield2:\s*(?<myextractvalue2>[^\]]*)"

rex field=_raw "myfield2:\s*(?<myextractvalue2>.*?)\]"

Re: How to escape the end bracket using rex?

poete — Wed, 20 Jun 2018 13:59:59 GMT

Hello,

this should do :

| makeresults 
| eval someField="[Status: 4] [myfield2: myvalue2][myfield3:myvalue3] [myfield4:myvalue4]"
| rex field=someField "myfield2: (?<myextractvalue2>[A-Za-z0-9]+)" 
| rex field=someField "myfield3:(?<myextractvalue3>[A-Za-z0-9]+)"
| rex field=someField "myfield4:(?<myextractvalue4>[A-Za-z0-9]+)"

Re: How to escape the end bracket using rex?

rbdev — Wed, 20 Jun 2018 14:01:31 GMT

EXCELLENT!! Thank you! The second actually worked better for me. The first one sometimes cut the value for some reason. But the second one perfect!