topic Re: Does Rex in splunk support variable in regular expression ? in Splunk Search

Does Rex in splunk support variable in regular expression?

Tao_Zeng — Tue, 09 Aug 2022 15:00:51 GMT

Does Rex in splunk support variable in regular expression ? For example, user could input a text from UI, usually I need a variable like $kw$ to get the input from user, and use $kw$ in rex command , Can splunk support this way ? and how ? Thanks.

Re: Does Rex in splunk support variable in regular expression ?

Tao_Zeng — Tue, 09 Aug 2022 06:47:26 GMT

Example, My raw text could be

"ue-CapabilityEnquiryExt": {"capabilityRequestFilterCommon": {"uplinkTxSwitchRequest-r16": "true"}, how can I embedded $kw$ in Rex expression , $kw$ is the text value input by user to search a certain key. it could be "uplinkTxSwitchRequest-r16" or some other key words .

I ever tried

rex field=_raw "\"$kw$\": \"(?<KeyValue>.*)\"", but didn't work

Re: Does Rex in splunk support variable in regular expression ?

ITWhisperer — Tue, 09 Aug 2022 07:27:00 GMT

In what way did this not work?

rex field=_raw "\"$kw$\": \"(?<KeyValue>.*)\""

Although, to be fair, this does rely on the user using a regex compatible match value, so you could try this (to make it easier for the user

rex field=_raw "\"$kw$[^\"]*\": \"(?<KeyValue>.*)\""

Re: Does Rex in splunk support variable in regular expression ?

Tao_Zeng — Tue, 09 Aug 2022 08:34:15 GMT

I tried again， rex field=_raw "\"$kw$\": \"(?<KeyValue>.*)\"" --- This acturally works.

and

rex field=_raw "\"$kw$[^\"]*\": \"(?<KeyValue>.*)\""

is good reminding.

Thanks ITWhisperer.

One more question is , $ is a special symbol on regular expression , how does Splunk identify it as a prefix of a variable or a regular expression symbol ?

Re: Does Rex in splunk support variable in regular expression ?

ITWhisperer — Tue, 09 Aug 2022 08:54:55 GMT

Yes, $ is a special symbol in rex, however, in this instance, you are specifying a token in a dashboard, and this is substituted into the search string before it is passed to the rex command.

Re: Does Rex in splunk support variable in regular expression ?

Tao_Zeng — Wed, 10 Aug 2022 02:04:44 GMT

This make sense， thanks for detailed explanation .