topic Re: How to use rex on a QR String to cut out a part that I want in Splunk Search

How to use rex on a QR String to cut out a part that I want

phamxuantung — Tue, 16 Nov 2021 02:55:01 GMT

I have a QR String that when put in our custom QR divider can took it apart nicely. But I can't use the field extraction for this. How do I use custom rex. Example:

- My QR String:00020101021253037045405100005802VN38620010A0000007270132000697110001180003131000000032040208QRIBFTTA624101121000000032040821 ORD_6328416304A3AC

- The string I want to take out is 00069711000118000313100000003204 and 000697 (The first 6 characters) as field1 and field2.

Fortunately the 4 characters before and 4 characters behind don't chance.

Re: How to use rex on a QR String to cut out a part that I want

venkatasri — Tue, 16 Nov 2021 03:54:47 GMT

Hi @phamxuantung

Without boundaries pre-defined set of chars ahead or delimiter or pattern its tough to extract. For rex the user has to give an indication from where to start extracting and where to end boundaries..

Re: How to use rex on a QR String to cut out a part that I want

phamxuantung — Tue, 16 Nov 2021 04:01:39 GMT

hi @venkatasri

The 4 characters before the string start always be 0132 and the 4 characters after the string end always be 0208. Will this be more feasible?

Re: How to use rex on a QR String to cut out a part that I want

venkatasri — Tue, 16 Nov 2021 04:43:34 GMT

This should work.

| makeresults | eval str="00020101021253037045405100005802VN38620010A0000007270132000697110001180003131000000032040208QRIBFTTA624101121000000032040821 ORD_6328416304A3AC" | rex field=str "^\w+0132(?<field1>\S+)0208" | eval field2=substr(field1,0,6) | table field*