topic Re: Can you help me create the regex that captures a string with a space in it? in Splunk Search

Can you help me create the regex that captures a string with a space in it?

jip31 — Tue, 27 Nov 2018 06:20:04 GMT

Hello

I have a field with a space in the string :

Model=WDC WD5000LPLX-60ZNTT1

But SPLUNK displays only the characters WDC because of the space.

I need a regex please which displays WDC WD5000LPLX-60ZNTT1 (so with the space) but that will be readable by Splunk.

Thanks!

Re: Can you help me create the regex that captures a string with a space in it?

woodcock — Tue, 27 Nov 2018 06:28:46 GMT

we need to see the entire event (preferably several of them).

Re: Can you help me create the regex that captures a string with a space in it?

MathiasLindblom — Tue, 27 Nov 2018 07:13:30 GMT

If we assume that whatever comes after Model= is fixed, eg:

Model=WDC WD5000LPLX-60ZNTT1 Test=XYZ

You could use a lookahead to "Test" like this:

    Model=(?P<Model>.*(?!Test))\s

Hope this could help, otherwise it would help with the entire event as mentioned before.

Re: Can you help me create the regex that captures a string with a space in it?

jip31 — Tue, 27 Nov 2018 08:44:37 GMT

I done | rex field=Caption "(?P(?!Test))\s" but i have the message⚠ Error in 'rex' command: Encountered the following error while compiling the regex '(?P(?!Test))\s': Regex: unrecognized character after (?P

Re: Can you help me create the regex that captures a string with a space in it?

jip31 — Tue, 27 Nov 2018 08:46:08 GMT

here is an example of one event fields
20181121161210.530611
Caption=WDC WD5000LPLX-60ZNTT1
DeviceID=\.\PHYSICALDRIVE0
FirmwareRevision=02.01A02
Model=WDC WD5000LPLX-60ZNTT1
Name=\.\PHYSICALDRIVE0
Size=500105249280
Status=OK
wmi_type=DiskDrive

Re: Can you help me create the regex that captures a string with a space in it?

MathiasLindblom — Tue, 27 Nov 2018 09:25:42 GMT

Hi,

seems like I lost a few characters when posting. If the event are as you described above, where they are all on each line, this regex should work:

| rex field=_raw "Model=(?P<Model>[^\n]*)"

Re: Can you help me create the regex that captures a string with a space in it?

MathiasLindblom — Tue, 27 Nov 2018 09:32:23 GMT

If the event is on one line, you can use this:

| rex field=_raw "Model=(?P<Model>.*?)\sName"

Re: Can you help me create the regex that captures a string with a space in it?

jip31 — Tue, 27 Nov 2018 09:42:01 GMT

perfect thanks