topic Re: Pass a token to regex or pass a field to regex in Splunk Search

Pass a token to regex or pass a field to regex

spicy — Thu, 29 Jul 2021 20:34:42 GMT

I am extracting a list of free text string in the _ raw and creating a new field.
The list of terms comes from user input, on the search input of a dashboard.

I cant seem to find how to place the token/variable in the regex... probably something easy im missing.

$token$="test|google|domain|badguy" (formmated this way so regex can see it as OR separated list)
rex field=_raw " (?<extractedfieldname>$token$) (does not work)

Is there a way to do this?

if not a token option, can i:

eval tokenname=$token$
rex field=_raw " (?<extractedfieldname>'tokenname') (does not work)

After the token/variable is placed correctly this is the search format im looking for:

rex field=_raw " (?<extractedfieldname>test|google|domain|badguy) (this does work)

thanks for any help!

Re: Pass a token to regex or pass a field to regex

ITWhisperer — Thu, 29 Jul 2021 21:35:13 GMT

You could try something like this

The first part (before the blank lines) sets up some sample dummy events.

The second part sets a field to be the regex you want (could be from a token), then uses replace to extract the matching string from _raw. If there is no match, the matched string is equal to _raw so this just needs to be replaced with null in this instance.

Re: Pass a token to regex or pass a field to regex

spicy — Thu, 29 Jul 2021 23:40:10 GMT

with the replace is it only gonna show me one hit from the passed list or does it need to be appended in some way?

Re: Pass a token to regex or pass a field to regex

spicy — Fri, 30 Jul 2021 00:28:43 GMT

| rex max_match=0 field=_raw "(?<extractedfieldname>(17|7|1))"

this will work but will still need the variable to be passed to this rex

Re: Pass a token to regex or pass a field to regex

ITWhisperer — Fri, 30 Jul 2021 06:38:46 GMT

Yes you are going to get one hit (which is what your examples were doing); in this case it will be the last one. If you want the first one add a ? to the first unnamed group

| eval extractedfieldname=replace(_raw,"(?:.*?)(?<t>".search.")(?:.*)","\1")