topic Re: Rex and Regex Field Extraction in Splunk Search

Rex and Regex Field Extraction

mistertj3 — Mon, 28 Sep 2020 13:37:46 GMT

Hello all,

I am trying to extract fields (tried the dynamic extraction and manual using rex&regex) but am unable to get it just right. My data looks like the following:

Apr 30 00:48:25 "ip_address" Apr 30 2012 00:48:25: %ASA-4-113019: Group = "Group",
Username = "User", IP = "ip_address",
Session disconnected. Session Type: SSL, Duration: 1h:59m:24s, Bytes xmt: 86659734,
Bytes rcv: 4557700, Reason: User Requested

I would like to extract the Bytes xmt and Bytes rcv to separate fields (on search time). Then I would like pipe to an eval statement that adds them then another pipe to the timechart.

I have tried a lot of regex and rex combinations using this site regular expression reference as a ref . But I've only gotten as far as rex field=_raw "Bytes xmt: (?.,)" , which only gives the first decimal?

I am probably doing this entirely wrong as this is my first expression so any help you can give would be great!

Thank you,

Re: Rex and Regex Field Extraction

lain179 — Wed, 27 Mar 2013 18:42:51 GMT

How about

rex field=_raw ".*Bytes xmt: (?<bxmt>\d+), Bytes rcv: (?<brcv>\d+),.*"

Re: Rex and Regex Field Extraction

mistertj3 — Wed, 27 Mar 2013 19:15:14 GMT

Thank you for your prompt response. I've copied and pasted what you've wrote, but the extracted fields bxmt and brcv do not show up under the selected fields nor interesting fields, so seemingly they have not been extracted. Is there something I'm missing or do I just pipe the additional statements (eval and timechart)?

Re: Rex and Regex Field Extraction

cphair — Wed, 27 Mar 2013 19:39:32 GMT

There should be backslashes in front of the d+ characters. The comment forum doesn't always post them properly.

Re: Rex and Regex Field Extraction

sowings — Wed, 27 Mar 2013 20:25:14 GMT

Edited to show the backslashes.

Re: Rex and Regex Field Extraction

mistertj3 — Sat, 30 Mar 2013 17:58:43 GMT

Got it and now have a better understanding of rex&regex. Thank you for all of your help and prompt responses!