How to edit my regex to remove all text before ":" if there is more than one

nikolaevnz — Thu, 02 Jun 2022 13:16:59 GMT

Hello Team, Splunkers,

I am working on a correlation search and need to use a regex expression to strip all text before a column ":". Following the suggestion presented in:

I managed to strip the text using this expression which was derived from the topic above:

| rex field=my_host "(?<my_host>[^\:]+)$"

and apply it to the following line:

Microsoft.Windows.Server.10.0.LogicalDisk:my_host.server;D

it will work and I will receive: my_host.server;D

However if I apply the above expression to the same line but with column at the end of the string looking like this:

Microsoft.Windows.Server.10.0.LogicalDisk:my_host.server;D:

this will not be matched. Could you please assist me with editing my expression to cover both cases and still get my_host.server;D as a result.

Regards Nikolay

Re: How to edit my regex to remove all text before ":" if there is more than one

richgalloway — Thu, 02 Jun 2022 13:41:19 GMT

Try this command. There may be other expressions that accomplish the same thing, but this one matches the examples provided.

| rex field=my_host ":(?<my_host>[^\:]+):?$"

nikolaevnz — Tue, 07 Jun 2022 06:31:29 GMT

Thank you for the help it woks as intended.