topic Re: Rex field to extract dot net module in Splunk Search

Rex field to extract dot net module

totaro — Mon, 09 Dec 2019 02:14:52 GMT

Hi i currently have the following line in my search that search for system.net.webclient:

|rex max_match=0 "(?<module>(system.net.webclient))"

May i know how do i amend this to search for any syntax that match system.xxx.xxx so it work for all the module?

vnravikumar — Mon, 09 Dec 2019 03:38:25 GMT

check this

| makeresults 
| eval test= "system.com.testclient" 
| rex field=test max_match=0 "(?<module>(system\.\w+\.\w+))"

richgalloway — Mon, 09 Dec 2019 03:47:36 GMT

Try |rex max_match=0 "(?<module>system\.[^\.]+\.\S+)".

totaro — Mon, 09 Dec 2019 07:58:25 GMT

This actually works better if the data was more organize; sadly my data was not and it capture too many noise