topic rex command help in Splunk Search

rex command help

sravankaripe — Wed, 15 Feb 2017 21:23:40 GMT

Help me with Rex

"keys":"values"

"SSOUSERDATA":"INDV=12345678|ONE|testd44|ABCD,ABCD_ABCDABCD"
"X-comGlobalSessionID":"Abcdef2OtOEWYEX0TA6B1KQ"
"X-comPrimaryIdentity":"12345678"
"X-comImpersonatedIdentity":"12345678"
"msgContentType":"Exception due to so and so"

Re: rex command help

skoelpin — Wed, 15 Feb 2017 21:34:30 GMT

How about this?

... | rex \":\"(?<skoelpin>.+)(?=\")

Your fieldname will be skoelpin 🙂

Re: rex command help

jkat54 — Wed, 15 Feb 2017 21:42:02 GMT

...|extract kvdelim=":" pairdelim=" "

If that works in search, it can be done automatically in props.conf too

Re: rex command help

sravankaripe — Wed, 15 Feb 2017 21:43:17 GMT

i want to retrive "INDV=12345678|ONE|testd44|ABCD,ABCD_ABCDABCD"
from the event. can you help me with rex.

"SSOUSERDATA":"INDV=12345678|ONE|testd44|ABCD,ABCD_ABCDABCD"

Re: rex command help

skoelpin — Wed, 15 Feb 2017 21:49:47 GMT

This will capture the value "INDV=12345678|ONE|testd44|ABCD,ABCD_ABCDABCD"

... | rex \":\"(?<skoelpin>.+)(?=\")

Re: rex command help

skoelpin — Wed, 15 Feb 2017 21:50:38 GMT

This would be the obvious choice, but OP said he wanted rex