https://community.splunk.com/t5/Splunk-Search/rex-not-working-for-log4j/m-p/62461#M15420 <P>trying to extract COMPANY from each matched log line, given tomcat log4j lines like this:</P> <PRE><CODE>31 Jan 2012 23:59:39,963 [com.action.ProcessPassword] (TP-Processor87) (8e48955b5d66036:24.6.170.156) DEBUG: Started executeExternalProcessPassword() for name @ COMPANY </CODE></PRE> <P>why doesn't this rex work? (no results)</P> <PRE><CODE>index="myIndex" rex field=_raw "executeExternalProcessPassword.* @ (?&lt;org&gt;.*)" </CODE></PRE> <P>just <CODE>index="myIndex" "executeExternalProcessPassword"</CODE> returns 22k+ lines from just one day log span</P> <P>this works perfectly:</P> <PRE><CODE>perl -ne 'if (/executeExternalProcessPassword.*@(.+)$/) {print "$1\n"}' catalina.out </CODE></PRE> Wed, 01 Feb 2012 20:57:59 GMT pcorchary 2012-02-01T20:57:59Z https://community.splunk.com/t5/Splunk-Search/rex-not-working-for-log4j/m-p/62461#M15420 <P>trying to extract COMPANY from each matched log line, given tomcat log4j lines like this:</P> <PRE><CODE>31 Jan 2012 23:59:39,963 [com.action.ProcessPassword] (TP-Processor87) (8e48955b5d66036:24.6.170.156) DEBUG: Started executeExternalProcessPassword() for name @ COMPANY </CODE></PRE> <P>why doesn't this rex work? (no results)</P> <PRE><CODE>index="myIndex" rex field=_raw "executeExternalProcessPassword.* @ (?&lt;org&gt;.*)" </CODE></PRE> <P>just <CODE>index="myIndex" "executeExternalProcessPassword"</CODE> returns 22k+ lines from just one day log span</P> <P>this works perfectly:</P> <PRE><CODE>perl -ne 'if (/executeExternalProcessPassword.*@(.+)$/) {print "$1\n"}' catalina.out </CODE></PRE> Wed, 01 Feb 2012 20:57:59 GMT https://community.splunk.com/t5/Splunk-Search/rex-not-working-for-log4j/m-p/62461#M15420 pcorchary 2012-02-01T20:57:59Z https://community.splunk.com/t5/Splunk-Search/rex-not-working-for-log4j/m-p/62462#M15421 <P>The spacing appears different in the different regexes that you are showing. Maybe it's just the linebreaking or the font of your post, though. Try</P> <PRE><CODE>index=myIndex | rex "executeExternalProcessPassword.*@(?&lt;org&gt;.+)$" </CODE></PRE> Wed, 01 Feb 2012 21:20:26 GMT https://community.splunk.com/t5/Splunk-Search/rex-not-working-for-log4j/m-p/62462#M15421 lguinn2 2012-02-01T21:20:26Z https://community.splunk.com/t5/Splunk-Search/rex-not-working-for-log4j/m-p/62463#M15422 <P>We were discussing this in <CODE>#splunk</CODE> IRC, and the missing pipe character before <CODE>rex</CODE> in the question/example turned out to be the real culprit.</P> Wed, 01 Feb 2012 21:33:12 GMT https://community.splunk.com/t5/Splunk-Search/rex-not-working-for-log4j/m-p/62463#M15422 dwaddle 2012-02-01T21:33:12Z