topic Re: Help with some basic REGEX please? in Splunk Search

Help with some basic REGEX please?

pir8radio — Tue, 22 Oct 2019 03:06:15 GMT

In this string: Version=\x221.7.53a\x22
I want to capture everything in between \x22 and \x22 so the result on this string would be 1.7.53a
but some other strings could look like Version=\x224.3.0.15\x22 the result should be 4.3.0.15

there are other fields like user=\x22username\x22 that i dont care about, just the version=\x22.........\x22
Any help would be appreciated.

Re: Help with some basic REGEX please?

richgalloway — Tue, 22 Oct 2019 06:07:04 GMT

At search time, you can use | rex field=Version "\\x22(?<version>[^\\]+)\\22".

Re: Help with some basic REGEX please?

Jawahir — Tue, 22 Oct 2019 13:44:05 GMT

try this : | rex field=Version "\\x22(?<version>.*)\\x22"

Re: Help with some basic REGEX please?

pir8radio — Tue, 29 Oct 2019 01:49:35 GMT

either I'm using this incorrectly, or its not working, here is the full string in the database:

172.69.63.125 - - [28/Oct/2019:20:40:58 -0500] "POST /emby/Sessions/Playing/Progress HTTP/1.1" 204 0 "-" "Dalvik/2.1.0 (Linux; U; Android 7.1.2; AFTMM Build/NS6266)" "2601:243:ca80:35ce:31dc:3f3f:5f8e:3718
forwarded_for
" 0.042 443 "MediaBrowser Client=\x22AndroidTv\x22, DeviceId=\x22dec6c5313ff588a2\x22, Device=\x22Bedroom TV\x22, Version=\x221.7.53a\x22, UserId=\x22e76db24xxxxxxxxxxxxd7a988641618\x22"

i want to extract a Field using regex, i would like out of the above string "1.7.53a" for field Version Various versions exist, one could be 4.3.0.15 or 1.7.53 or 1.7.53a etc... so basically in the above access log i want to grab that version field and get rid of the \x22 on each side of the version number.

Re: Help with some basic REGEX please?

arjunpkishore5 — Tue, 29 Oct 2019 10:32:46 GMT

I think you meant | rex field=Version "\\x22(?<version>[^\\]+)\\x22"

You missed the x at the end 😉

Re: Help with some basic REGEX please?

arjunpkishore5 — Tue, 29 Oct 2019 11:59:39 GMT

Based on the data you posted in @richgalloway Answer, it looks like there are no field extractions on your data. so this is what you probably need

| rex field=_raw "Version=\\x22(?<version>[^\\]+)\\x22"

If you do have field extractions, @richgalloway 's answer is right except for a small error. there's a missing x at the end. so this is what you need. I posted this as a comment on his answer. If this work's, Please upvote his answer and mark this as the answer

| rex field=Version "\\x22(?<version>[^\\]+)\\x22"

Re: Help with some basic REGEX please?

wenthold — Wed, 30 Oct 2019 20:21:01 GMT

Escaping backlashes with rex is strange. You could use three slashes:

| rex field=_raw "Version=\\\x22(?<Version>.*?)\\\x"

or use \x5c:

| rex field=_raw "Version=\x5cx22(?<Version>.*?)\x5cx"