topic Re: Extracting words in a string with regular expressions in Splunk Search

Extracting words in a string with regular expressions

7ryota — Wed, 12 Jan 2022 06:54:46 GMT

Hi,

i need help to extract word from a string

string

Security agent installation attempted Endpoint: (Not Found)
Security agent intstallation attempted Endpoint: hostname

result

Not Found

hostname

how can i construct a regular expression to extract out what i wanted?

Re: Extracting words in a string with regular expressions

gcusello — Wed, 12 Jan 2022 07:27:44 GMT

Hi @7ryota,

you could use two regexes like the following:

| rex ":\s+\(*(?<result>.+)" | rex field=result "^(?<result>[^)]+)"

The first extract the full value and the second deletes the parenthesis when present.

Ciao.

Giuseppe

Re: Extracting words in a string with regular expressions

inventsekar — Wed, 12 Jan 2022 08:04:27 GMT

not sure how to remove the ")" at the "Not Found)"

|makeresults | eval string="Security agent installation attempted Endpoint: (Not Found) Security agent intstallation attempted Endpoint: hostname" | rex field=string max_match=0 ":\s+\(?(?P<result>.+)" |table string result

Re: Extracting words in a string with regular expressions

ITWhisperer — Wed, 12 Jan 2022 08:38:00 GMT

| rex ":\s+\(*(?<result>[^)]+)"

Re: Extracting words in a string with regular expressions

inventsekar — Wed, 12 Jan 2022 13:48:22 GMT

Hi @ITWhisperer ... i am trying to learn and understand your rex, as i ran it, but it does not fetch the string.. not sure what went wrong.. please suggest.

i used this search:

|makeresults | eval string="Security agent installation attempted Endpoint: (Not Found) Security agent intstallation attempted Endpoint: hostname" | rex ":\s+\(*(?<result>[^)]+)" |table string result

Re: Extracting words in a string with regular expressions

ITWhisperer — Wed, 12 Jan 2022 14:08:31 GMT

By default, rex operates on the _raw field. Either change your eval so it assigns to _raw rather than string or add field=string to the rex

Re: Extracting words in a string with regular expressions

inventsekar — Wed, 12 Jan 2022 15:35:06 GMT

Sure @ITWhisperer , but, still it found only first match.. the "hostname" was not matched..

Re: Extracting words in a string with regular expressions

ITWhisperer — Wed, 12 Jan 2022 16:05:20 GMT

You can use rex max_match=0 to get multiple matches