topic Re: regex to fetch a particular field available in different places in different events in Splunk Search

regex to fetch a particular field available in different places in different events

dtccsundar — Tue, 23 Nov 2021 08:07:35 GMT

I have a field( version) which is available in different position in different events of same sourcetype,Since the prior field(description) to this has irregular count of characters .Due to this is am seeing null values wherever the field(version) in different positions.

I would want fetch the field(version) wherever the field is available in the events of sourcetype.I tried the below ,

| rex field=_raw "Version=(?<Version>\"\w+\s+\w+\".*?)," | rex mode=sed field=Version "s/\\\"//g"

but it didn't worked .Please suggest me a way to fetch this .

Re: regex to fetch a particular field available in different places in different events

ITWhisperer — Tue, 23 Nov 2021 08:14:02 GMT

It looks like the rex should work except when the field is not followed by a comma.

Can you provide some sample events of both working and not working cases?

Re: regex to fetch a particular field available in different places in different events

dtccsundar — Tue, 23 Nov 2021 08:30:34 GMT

It works here,Actually it gives data normally without regex

11/23/21 2:12:05.169 AM 2021-11-23 02:12:05.169, Name="LS4J4XMV2", DN="LS4J4XMV2.corp.mtnn.com", Factor="Laptop", Tag="121907", Company="MTNN", Status="Installed",Group="End User Support", Location="WFH", OS="Windows 10 Enterprise", Last_Discovered_On="2021-11-19 12:43:56", IP_Address="172.29.120.28", Number="4J4XMV2", Class="Computer", Domain="global", IT_Status="Active", Discoverable="true", sysid="0045134fdb75f34829a475fb8c961929", Assigned_To="Sandro", Comments="2021-02-23: 'In Transit' - Device is defective and being returned to office by user.", Version="32.35.0", F_IP_Address="192.168.0.251", F_Agent_ID="oz2cqkQi7eddOhEwvZX", F_Last_Audit="2021-11-18 02:27:47.0000000", Polled_On="2021-11-18 02:27:42.0000000", Reporting_Status="Reporting", _Match_Type="FQDN", _Match_ITAM="LS4J4XMV2", _Match_Tool="LS4J4XMV2", _IngestionID="F1685D71-751B-461A-8146-EBF51C71BEF5"

This not gives actual version after using regex too .It gives blank after filling null

11/23/21 2:12:04.916 AM 2021-11-23 02:12:04.916, Name="LS8N4YPQ2", DN="LS8N4YPQ2.corp.mtnn.com", Factor="Laptop", Tag="148237", Status="Installed", Group="End User Support", Location="MNP01-108", OS="Windows 10 Enterprise", Last_Discovered_On="2021-11-19 07:51:29", IP_Address="172.29.119.234", Number="8N4YPQ2", Class="Computer", Domain="global", IT_Status="Active", Discoverable="true", sysid="0007f529dbe0e3c49d109ee8db96194e", Assigned_To="Leonard", Description="2019-09-13 No recent discovery. LS8N4YPQ2 not in McAfee ePO. Setting status to "In Stock"", Version="32.35.0", F_IP_Address="192.168.24.11", F_Agent_ID="h7r8wz0zFCfdbvcu4xc", F_Last_Audit="2021-11-19 16:52:56.0000000", Polled_On="2021-11-19 17:22:54.0000000", Reporting_Status="Reporting", _Match_Type="FQDN", _Match_ITAM="LS8N4YPQ2", _Match_Tool="LS8N4YPQ2", _IngestionID="C4432752-1B32-4799-8204-3B966AB115B0"

Re: regex to fetch a particular field available in different places in different events

dtccsundar — Tue, 23 Nov 2021 10:22:10 GMT

Please let me know if you require more info on this .

Re: regex to fetch a particular field available in different places in different events

ITWhisperer — Tue, 23 Nov 2021 14:37:59 GMT

Neither of these version strings would be picked up by your rex expression since they don't have spaces in.

Since you go on to remove the double quotes, why not not capture them in the first place?

| rex "Version=\"(?<Version>[^\"]+)\""