topic Re: How do you write a regular expression to extract a field between two colons with a particular pattern? in Splunk Search

How do you write a regular expression to extract a field between two colons with a particular pattern?

kcchu01 — Fri, 26 Oct 2018 10:05:14 GMT

Hi,

Can anyone teach me how to write a regular expression to extract the field on the following raw event?

sendmail[11111]: w9234FKJa23233: to=xxxxxx

I would like to extract the "w9234FKJa23233" and create a new field that starts with "w" and then 13 char/digits.

Thanks a lot

harsmarvania57 — Fri, 26 Oct 2018 10:27:13 GMT

Hi @kcchu01,

Please try below regex, this will extract everything between : and :

<yourBaseSearch> | rex field=_raw "(?:\s(?<extracted_field>[^\:]+)[\:])"

If you want results which only starts with w then try below regex

<yourBaseSearch> | rex field=_raw "(?:\s(?<extracted_field>w[^\:]+)[\:])"

kcchu01 — Mon, 29 Oct 2018 09:39:40 GMT

Thanks a lot, the field is extracted perfectly.

lakromani — Mon, 29 Oct 2018 10:11:01 GMT

Your regex is not 100% correct. It matches any text from a space up to :
It will also give data from this line with only one :

sendmail[11111] w9234FKJa23233: to=xxxxxx

So a more correct regex would be:

(?::\s(?<extracted_field>[^\:]+)[\:])

It will extract all data between two :, except the first space.

Also you do not need to escape the : or put it in brackets at the end, so:

(?::\s(?<extracted_field>[^:]+):)