topic Re: Regex help in Splunk Search

Regex help

tkerr1357 — Fri, 05 Feb 2021 17:35:55 GMT

hey all looking for some help pulling some digits via regex. I am looking to pull the numbers directly after Actual value(in the example event below 48). I would like to exclude the quotes and comma if possible.

LogName=LoginPI Events EventCode=1300 EventType=4 ComputerName=RNBSVSIMGT02.rightnetworks.com SourceName=Login Threshold Exceeded Type=Information RecordNumber=285782 Keywords=Classic TaskCategory=None OpCode=Info Message={ "Description": "Total login time (48s) exceeded threshold of 45s (6.67%)", "Actual value": "48", "Threshold value": "45", "AccountId": "4c06e54e-ab5f-47a6-2cc7-08d807c9fae2", "AccountName": "rightnetworks\\eloginpi049", "LauncherName": "RNBSVSI21", "Locale": "English (United States)", "RemotingProtocol": "Rdp", "Resolution": "1920 × 1080", "ScaleFactor": "100%", "TargetHost": "BPSQCP00S143", "TargetOS": "Microsoft Windows Server 2016 Standard 10.0.14393 (1607)", "EnvironmentName": "BPSQCP00S143", "EnvironmentId": "06a3c4a2-6f73-4c54-94e9-08d8040960f8", "Title": "Login time threshold exceeded"

Re: Regex help

gcusello — Fri, 05 Feb 2021 17:40:48 GMT

Hi @tkerr1357,

please, try this:

| rex "Actual\s+value\":\s+\"(?<actual_value>[^\"]+)\""

that you can test at https://regex101.com/r/0CVPNF/1

Ciao.

Giuseppe

Re: Regex help

saravanan90 — Fri, 05 Feb 2021 17:45:07 GMT

This may help..

|makeresults | eval _raw="LogName=LoginPI Events EventCode=1300 EventType=4 ComputerName=RNBSVSIMGT02.rightnetworks.com SourceName=Login Threshold Exceeded Type=Information RecordNumber=285782 Keywords=Classic TaskCategory=None OpCode=Info Message={ \"Description\": \"Total login time (48s) exceeded threshold of 45s (6.67%)\", \"Actual value\": \"48\", \"Threshold value\": \"45\", \"AccountId\": \"4c06e54e-ab5f-47a6-2cc7-08d807c9fae2\", \"AccountName\": \"rightnetworks\\eloginpi049\", \"LauncherName\": \"RNBSVSI21\", \"Locale\": \"English (United States)\", \"RemotingProtocol\": \"Rdp\", \"Resolution\": \"1920 × 1080\", \"ScaleFactor\": \"100%\", \"TargetHost\": \"BPSQCP00S143\", \"TargetOS\": \"Microsoft Windows Server 2016 Standard 10.0.14393 (1607)\", \"EnvironmentName\": \"BPSQCP00S143\", \"EnvironmentId\": \"06a3c4a2-6f73-4c54-94e9-08d8040960f8\", \"Title\": \"Login time threshold exceeded" | rex field=_raw "Actual value\\\":\s+\\\"(?<actual_value>\d+)"

Re: Regex help

tkerr1357 — Fri, 05 Feb 2021 18:17:52 GMT

both of those worked thank you !!!