topic Re: REX-Field Extraction Issues with Special Characters in Splunk Search

REX-Field Extraction Issues with Special Characters

SplunkDash — Tue, 07 Sep 2021 16:38:07 GMT

Hello,

I have following Sample Event.

Q17CNB_L_0__20210630-235755_5828.html@^@^2021/06/30@^@^23:57:55@^@^ Q17CNB @^@^

I have following REX command to extract ID and DateTime Fields from it

rex "(?<ID>.{6}).*?@\^@\^(?<DateTime>\d\d\d\d\/\d\d\/\d\d@\^@\^\d\d:\d\d:\d\d)

ID looked as expected, but I got DateTime Field as "2021/06/30@^@^23:57:55" . Is there anyways, we can have DateTime Field like "2021/06/30 23:57:55"....without (@^@^) from this Event. Thank you so much, appreciate your support in these efforts.

Re: REX-Field Extraction Issues with Special Characters

SaltyHash123 — Tue, 07 Sep 2021 16:44:38 GMT

You could either replace the character with a space

something like

| eval dateField = replace(dateField,"@^", " ")

Maybe you'll have to escape ^ with \^

otherwise you could create a field for the date and one for the time and append them into a new field (most probably less performance)

Re: REX-Field Extraction Issues with Special Characters

SplunkDash — Tue, 07 Sep 2021 16:59:24 GMT

Thank you so much, appreciate your support.

I think your codes is working as expected. I just have done some tweaking based on your recommendation ......working as expected. Here is the final code:

| rex "(?<ID>.{6}).*?@\^@\^(?<DateTime>\d\d\d\d\/\d\d\/\d\d@\^@\^\d\d:\d\d:\d\d)"

| eval DateTime = replace(DateTime,"@\^@\^", " ")

Thank you again.

Re: REX-Field Extraction Issues with Special Characters

SaltyHash123 — Tue, 07 Sep 2021 21:16:59 GMT

I am glad it helped. Btw you can optimize your regular expression

You could for example use \d{4} instead of \d\d\d\d .

You can checkout a cheat sheet like https://cheatography.com/davechild/cheat-sheets/regular-expressions/ for some useful commands 🙂