topic Fetch exact value using REX command in Splunk Search

Fetch exact value using REX command

sgulhane5 — Thu, 15 Oct 2020 11:07:09 GMT

Hi,

Can someone please help me here: To fetch

value = private and operation= OVERRIDE using rex command?

I tried to fetch using below command:

|rex max_match=0 field=_raw "IP BLOCK TYPE\",value=\"(?<IP_Block_Type>.*?)\s*(\w*+)\]"| eval IP_Block_Type= substr(IP_Block_Type, 1, len(IP_Block_Type)-1)

|rex max_match=0 field=_raw "IP BLOCK TYPE\",operation=\"(?<IP_Block_Type>.*?)\s*(\w*+)\]"| eval IP_Block_Type= substr(IP_Block_Type, 1, len(IP_Block_Type)-1)

[name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"]

Re: Fetch exact value using REX command

gcusello — Thu, 15 Oct 2020 11:15:36 GMT

Hi @sgulhane5,

if the logs you have is something like what you shared

[name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"]

you don't need a dedicated regex extraction because Splunk automatically recognizes pairs field=value.

Anyway, you can extract "Private" and "OVERRIDE" using this regex

| rex "value\=\"(?<value>[^\"]*)\",operation\=\"(?<operation>[^\"]*)"

that you can test at https://regex101.com/r/Y2VMtX/1

Ciao.

Giuseppe

Re: Fetch exact value using REX command

sgulhane5 — Fri, 16 Oct 2020 15:56:56 GMT

not working

Re: Fetch exact value using REX command

sgulhane5 — Fri, 16 Oct 2020 16:01:58 GMT

@gcusello the log message is looks like [name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"]. I just wanted to fetch operation="OVERRIDE" through the regex.

Re: Fetch exact value using REX command

somesoni2 — Fri, 16 Oct 2020 19:08:09 GMT

What issues are you facing using @gcusello 's answer?

Re: Fetch exact value using REX command

gcusello — Sat, 17 Oct 2020 10:04:56 GMT

Hi @sgulhane5,

if you want to extract the value "OVERRIDE" and put it in the field "operation", my regex is correct, if instead you want all the string "operation=OVERRIDE", it's different.

Please confirm that you have the message:

[name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"]

and that you want to extract the value "Private" and put it into the field "value" and the value "OVERRIDE" and put it into the field "operation".

Only one additional question: message is a field of your full row log?

If it's the full row log, my regex is correct, if instead message is a field, you have to modify my rex command:

| rex field=message "value\=\"(?<value>[^\"]*)\",operation\=\"(?<operation>[^\"]*)"

Ciao.

Giuseppe