topic How come my rex command doesn't give results as expected? in Splunk Search

How come my rex command doesn't give results as expected?

ananth402 — Wed, 03 Apr 2019 18:47:51 GMT

I have the following log statement and I would like to retrieve the mac address which is a 12 digit string from it.

msgType=notifications notification={"device":"mac:Ab12Cd34nm67","cam":"{\"mac\":\"Ab:12:Cd:34:nm:67\",\"Number\":\"AAAAAAAAA\",.....}"}

I tried with

 host=host* source="source.log" "msgType=notifications*" | rex "(?<mac:.{12})>"

I'm looking for the string mac:Ab12Cd34nm67. How can change the regex to obtain the expected string?

Re: How come my rex command doesn't give results as expected?

ananth402 — Wed, 03 Apr 2019 19:07:02 GMT

tried using host=host* source="source.log" "msgType=notifications*" | rex "mac:(?<mac_number>)" | stats count by mac_number doesn't give me any results

Re: How come my rex command doesn't give results as expected?

somesoni2 — Wed, 03 Apr 2019 19:07:02 GMT

Try like this updated

 host=host* source="source.log" "msgType=notifications*" | rex "mac\:(?<mac>.{12})"

Re: How come my rex command doesn't give results as expected?

ananth402 — Wed, 03 Apr 2019 19:12:10 GMT

There seems to be an issue with the regex statement because it shows Premature end of data in tag form line 1 when I try to use it

Re: How come my rex command doesn't give results as expected?

somesoni2 — Wed, 03 Apr 2019 19:17:43 GMT

Yeah.. missed removing a >. Try the updated answer.