topic Re: Splunk Cloud rex extraction on search in Splunk Search

Splunk Cloud rex extraction on search

onedarr — Tue, 10 Mar 2020 19:41:00 GMT

Attempt A index="w3c" | rex field=_raw "?(sessionid=?)\w{8}-\w{4}-\w{4}-\w{4}-\w{12}"  | table  ABC _raw
Attempt B index="w3c" | rex field=_raw "\.\sessionid\=\"(?P)[\w{8}]-[\w{4}]-[\w{4}]-[\w{4}]-[\w{12}]"  | table  ABC _raw
Attempt C index="w3c" | rex field=_raw "\.\sessionid\=\"(?P[\w{8}]-[\w{4}]-[\w{4}]-[\w{4}]-[\w{12}])"  | table  ABC _raw

(I used a named field ABC, it gets cut from this post)

FROM text:

.sessionid=d2a4f0de-747f-413c-a823-03ee7d241d5b&hash

The GOAL:

ABC = d2a4f0de-747f-413c-a823-03ee7d241d5b

Re: Splunk Cloud rex extraction on search

jscraig2006 — Tue, 10 Mar 2020 21:29:51 GMT

You can capture all up to the "&". Try this index="w3c"| rex "sessionid\=(?<vns_raw>[^\&]+)" Assuming that vns_raw is the field you are wanting to create. Otherwise you can change it to your needs.

Re: Splunk Cloud rex extraction on search

onedarr — Tue, 10 Mar 2020 21:43:22 GMT

vns was a typo, meant ABC. Thank you for your input, but your expression still returns null for that extracted field. I'm wondering if cloud has some special rules to the rex command? This seems like a bug but I don't have a good way to test in another splunk environment

Re: Splunk Cloud rex extraction on search

anmolpatel — Tue, 10 Mar 2020 22:31:48 GMT

| rex field=_raw "(\.sessionid=)(?<ABC>(\w*[\-\&]?)+)"

Re: Splunk Cloud rex extraction on search

codebuilder — Wed, 11 Mar 2020 04:55:51 GMT

I've posted on this topic previously, but one of the best yet most unknown features of Splunk is "erex".

Pipe the results or your search to erex, and provide a arbitrary name and "examples" (and/or counter-examples) of the value you are trying to extract. Once the search completes, view the job inspector and it will provide you with the proper regex query to extract the field you are after. It is extremely useful! It may not be perfect at first try, but builds the regex for you, then you can tweak and fine tune it (though generally it's pretty spot on).

https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Erex

Re: Splunk Cloud rex extraction on search

to4kawa — Wed, 11 Mar 2020 11:11:32 GMT

| makeresults
| eval _raw=".sessionid=d2a4f0de-747f-413c-a823-03ee7d241d5b&hash&test"
| rex "sessionid=(?<ABC>.*?)&"

Greedy matching of REGEX is useful.