topic Re: How do you extract fields that end with a question? in Splunk Search

How do you extract fields that end with a question?

Deepz2612 — Mon, 25 Feb 2019 09:58:16 GMT

I wanted to extract a field to capture the data before the question mark as below.

api_call "Get \search\ip\6789\?=number\90"

where api_call is an already extracted field.

I wrote it as a rex field = api_call "/"(?[^/?])" ---- result required is Get \search\ip\6789\
but it doesn't seem to work.

Re: How do you extract fields that end with a question?

FrankVl — Mon, 25 Feb 2019 10:04:56 GMT

When you want to escape special characters like quotes and questionmarks, you need to do that using a \ not a /. Anyway no need to escape that questionmark in that location in the regex. You also need to add a + to make it match multple non-? characters.

Try this: rex field = api_call "\"(?<field1>[^?]+)"

https://regex101.com/r/zaolbY/1

Re: How do you extract fields that end with a question?

markusspitzli — Mon, 25 Feb 2019 10:11:48 GMT

Hi @Deepz2612

I have tried this regex for extracting the field messsage. (it worked with regex101.com)
\"(?<message>\w+\s\S+)\?`

wit rex it should look like this:
rex field=api_call "\"(?<message>\w+\s\S+)\?"

Re: How do you extract fields that end with a question?

vnravikumar — Mon, 25 Feb 2019 15:40:03 GMT

Hi @Deepz2612

Please try

| makeresults 
| eval api_call= "Get \search\ip\6789\?=number\90" 
| rex field=api_call "(?P<result>.*)\?="

Re: How do you extract fields that end with a question?

FrankVl — Mon, 25 Feb 2019 16:40:02 GMT

Using .* should be avoided where possible (as it triggers excessive matching and backtracking) and in this case there is no need for it. (in this tiny example, it causes 30 steps to complete according to regex101, compared to 9 for my solution).

Re: How do you extract fields that end with a question?

FrankVl — Mon, 25 Feb 2019 16:41:10 GMT

Using \S+ is not very efficient (as it includes the ? and will require backtracking to get the actual match). And in this case there is no need for it. (in this tiny example, it causes 32 steps to complete according to regex101, compared to 9 for my solution).

Re: How do you extract fields that end with a question?

wrangler2x — Fri, 01 Mar 2019 00:27:39 GMT

This works:

| makeresults
| eval foo= "Get \search\ip\6789\?=number\90"
| rex field=foo "(?<api_call>[^\?]+)\?"
| table api_call foo

api_call                foo
Get \search\ip\6789\    Get \search\ip\6789\?=number\90