topic Need help on rex in Splunk Search

Need help on rex

Annna — Wed, 30 Dec 2020 12:36:11 GMT

wed } } }, { "S" : "12:00" } } }, "day" M" : { "close" : { "S" : "23:00" open "S" : "12:00" } } } } }, "email" : { "S" : " DHours" } } }, "email" : { "S" : " Hours" } } }]

| rex "wed.\D}.\D.\D.(?<sample>.*)DHours

i used above rex and gives the result like

{ "S" : "12:00" } } }, "day" M" : { "close" : { "S" : "23:00"open "S" : "12:00" } } } } }, "email" : { "S" : "

but i need below output

Result should be like

{ "S" : "12:00" } } }, "day" M" : { "close" : { "S" : "23:00"open "S" : "12:00" } } } } }

Re: Need help on rex

gcusello — Wed, 30 Dec 2020 12:45:48 GMT

Hi @Annna,

the results you have from your regex is the correct one for your regex, please try this:

| rex "wed.\D}.\D.\D.(?<sample>.*),\s+\"email\".*DHours"

that you can test at https://regex101.com/r/CutdeR/1

Ciao.

Giuseppe

Re: Need help on rex

Annna — Wed, 30 Dec 2020 12:47:39 GMT

its working. Thank you..!!

Re: Need help on rex

gcusello — Wed, 30 Dec 2020 13:03:31 GMT

Hi @Annna,

good for you.

Ciao and happy splunking.

Giuseppe

P.S. Karma Points are appreciated 😉