topic Re: How to get certain field from data using rex in Splunk Search

How to get certain field from data using rex

MeMilo09 — Thu, 13 May 2021 00:28:19 GMT

Hey There,

I have seen the Splunk. com answers and the rex cheat sheets online. However, I cant seem to get rex command to work to extract what I need from the data. I only need the XX_LMP_123456789_123 without the .pdf. Can someone guide me on how to achieve this?

just need XX_LMP_123456789_123

failureMsg="Failure to populate pdf file for XX_LMP_123456789_123.pdf in LOB_1234567_9_4567890_delivery_.pdf"

Re: How to get certain field from data using rex

tscroggins — Thu, 13 May 2021 00:51:58 GMT

@MeMilo09

This should work:

| rex field=failureMsg "for (?<basename>.*?)\\.pdf"

or this:

| rex field=failureMsg "for (?<basename>[^.]+)"

and others, depending on how much variation exists in your source text.

Re: How to get certain field from data using rex

MeMilo09 — Thu, 13 May 2021 23:45:16 GMT

@tscroggins

Thanks for your help this works perfectly. would you mind explaining the rex characters

| rex field=failureMsg "for (?<basename>[^.]+)"

"for" why use for here ?- this actually works even if the failureMsg does not begin with for, but not sure why.

? stands for 0 or 1, but my failureMsg could have letters too and it works fine. Can you explain why it works?

[^.]+ What is the rest doing - I am having a hard time understanding it

Your explanation would be very helpful for me. Thanks in advance.

Re: How to get certain field from data using rex

tscroggins — Fri, 14 May 2021 01:11:06 GMT

@MeMilo09

"for " forces a match against that exact text. Without it, your match should have included both the text before the base file name and the base file name itself. The source text doesn't need to begin with "for;" that would require additional logic in the regex.

The (?<xxx>...) sequence defines a capture group with name xxx. In Splunk, xxx becomes the extracted field name.

[^.]+ means "match one or more characters that are not a period." The match will stop when it encounters the dot in the file name.