topic How to extract text from raw data using rex? in Splunk Search

How to extract text from raw data using rex?

9jamie — Tue, 26 Apr 2022 19:03:13 GMT

I'm new to regex and having trouble extracting some text. My raw data is in the following format:

ID=[12839829389-8b7e89opf][2839128391DJ33838PR]

I need to extract the text between the first two brackets,12839829389-8b7e89opf, into a new field.

So far what I have does not work: | rex field=_raw "ID=[(?<id>.*)]"

If anyone could help it would be greatly appreciated.

Re: How to extract text from raw data using rex?

ITWhisperer — Tue, 26 Apr 2022 19:09:49 GMT

Square brackets are special characters in regex so need to be escaped with backslashes

| rex field=_raw "ID=\[(?<id>.*)\]"

Re: How to extract text from raw data using rex?

9jamie — Tue, 26 Apr 2022 19:42:35 GMT

this returns everything after ID up until the final closing bracket. so i added the brackets containing the second part of the id as well. final solution:

rex field=_raw "ID=\[(?<id>.*\]\[.*\]"

thanks for the help