topic Re: Need Regex help in Splunk Search

Need Regex help

SabariRajanT — Fri, 27 Aug 2021 16:06:24 GMT

Hi All,

I will be getting a list of MD5 hash values in my logs. Need a regex expression for the below.

Therefore whenever am getting md5 hash values.

"md5":"b78269ef4034474766cb1351e94edf5c",

Re: Need Regex help

gcusello — Fri, 27 Aug 2021 16:15:17 GMT

Hi @SabariRajanT,

please try this:

| rex "\"md5\":\"(?<md5>[^\"]+)"

that you can test at https://regex101.com/r/DPpHQi/1

Ciao.

Giuseppe

Re: Need Regex help

SabariRajanT — Fri, 27 Aug 2021 16:31:34 GMT

@gcusello Thanks for your quick response.

The rex which you provided it doesn't work for other data which has MD5. one thing I notice in logs before md5 that starts with "","" and end with "","". Using that can you provide rex.

"",""md5"":""b147fbdbd44374f73a763531c8d1093d"",""sha1"":null,""

Re: Need Regex help

gcusello — Fri, 27 Aug 2021 16:34:08 GMT

Hi @SabariRajanT,

ok, please try this:

| rex "\"\"md5\"\":\"\"(?<md5>[^\"]+)"

that you can test at https://regex101.com/r/DPpHQi/2

Ciao.

Giuseppe

Re: Need Regex help

SabariRajanT — Fri, 27 Aug 2021 16:53:44 GMT

@gcusello The rex which is provided earlier, doesn't working.

Thanks

Re: Need Regex help

gcusello — Fri, 27 Aug 2021 16:56:08 GMT

Hi @SabariRajanT,

Please, share some additional samples, because, as you can see, using the sample you provided it's running.

Ciao.

Giuseppe

Re: Need Regex help

SabariRajanT — Fri, 27 Aug 2021 17:08:39 GMT

Can I have your email Id please @gcusello to send the full logs. Since the file size is huge.

Re: Need Regex help

gcusello — Sat, 28 Aug 2021 09:26:52 GMT

Hi @SabariRajanT,

as you can see at https://regex101.com/r/DPpHQi/3

the first regex perfectly matches the sample you shared

| rex "\"md5\":\"(?<md5>[^\"]+)"

What's the behaviour of your regex? why do you see that it doesn't run?

Ciao.

Giuseppe