topic Re: How to extract a string from a field that contains letters, numbers and characters? in Splunk Search

How to extract a string from a field that contains letters, numbers and characters?

jfeitosa_real — Mon, 09 Sep 2019 17:48:38 GMT

731/5000
How to extract a field that can contain letters, numbers and characters, as in the example below?
The field to extract is the policyName that always comes preceded by the instanceId field.

Ex:

policyName = Unrestricted Inbound Access on network security groups instanceId = 5313
policyName = Unrestricted MongoDB Access in network security groups instanceId = 5313
policyName = [Exchange] - CPF totalMatchCount = 12 instanceId = 5319
policyName = Unencrypted OS disks instanceId = 5313
policyName = Check Disable Telnet (port 23) access on Network Security Groups from Internet instanceId = 5313

I have tried several ways, but it is only extracting the first word after the "=" sign, eg. "[Exchange]", "Unrestricted", etc ...

Can anyone help?

Thank you very much in advance.

Re: How to extract a string from a field that contains letters, numbers and characters?

Sukisen1981 — Mon, 09 Sep 2019 18:09:04 GMT

| makeresults |eval x="Ex: policyName = Unrestricted Inbound Access on network security groups instanceId = 5313
policyName = Unrestricted MongoDB Access in network security groups instanceId = 5313
policyName = [Exchange] - CPF totalMatchCount = 12 instanceId = 5319
policyName = Unencrypted OS disks instanceId = 5313
policyName = Check Disable Telnet (port 23) access on Network Security Groups from Internet instanceId = 5313" | rex field=x "policyName+\s+\=(?<pname>.*?)instanceId" max_match=0

Re: How to extract a string from a field that contains letters, numbers and characters?

jfeitosa_real — Mon, 09 Sep 2019 19:22:44 GMT

Hi Sukisen!

It worked in search time. But inline extract does not. What would it look like for extract inline?

Thank you.

James

Re: How to extract a string from a field that contains letters, numbers and characters?

Sukisen1981 — Wed, 30 Sep 2020 02:09:29 GMT

hi @jfeitosa_real
It should work in inline search as well.
Is the inline search a table in a dashboard? If yes, check the time range of the search
it could be that your logs are multispaced in that case use this regex - rex field=x "(?ms)policyName+\s+\=(?<pname>.*?)instanceId" max_match=0

Re: How to extract a string from a field that contains letters, numbers and characters?

jfeitosa_real — Tue, 10 Sep 2019 12:03:35 GMT

Hi @Sukisen1981 .

In fact it is to extract the field without research.

I got it this way:

(?:policyName=(?P<policy>.*)instanceId)

Thanks for your attention, your example helped me find this result.

Thank you very much.

James []s

Re: How to extract a string from a field that contains letters, numbers and characters?

jfeitosa_real — Tue, 10 Sep 2019 12:15:37 GMT

To extract the field in inline mode.

I used this REGEX:

(?:policyName = (?P<policy>.*)instanceId)

Thank you very much.