topic Re: Regex keeps extracting wrong data in Splunk Search

Why does regex keeps extracting wrong data?

jhilton90 — Fri, 04 Nov 2022 16:34:51 GMT

I am trying to use the rex command to extract an id number, which is a mixture of letters and numbers separated by a dash. For example, one of the ids looks like this:

34gv564-3333-5tg4-gt53-4rgt5eg5g35gb

The field itself is as follows: MFA challenge succeeded for account aaaaaaaaa with email example@example.co.uk. Session id is 34gv564-3333-5tg4-gt53-4rgt5eg5g35gb

The rex command I'm using is as follows:

| rex "(?i) is (?<id_number>[^\"]+)"

The only problem is that sometimes it extracts the email address bit too

Any help would be greatly appreciated

Re: Regex keeps extracting wrong data

karu0711 — Fri, 04 Nov 2022 12:55:21 GMT

try this

| rex ^(?<id_number>.+)

Re: Regex keeps extracting wrong data

jhilton90 — Fri, 04 Nov 2022 14:21:42 GMT

That just extracts the entire event unfortunately

Thanks anyway though

Re: Regex keeps extracting wrong data

richgalloway — Fri, 04 Nov 2022 15:36:51 GMT

To avoid extracting data from the wrong place, the regex should be more specific.

| rex "Session id is (?<id_number>[^\"]+)"

Since we only have a partial event to work with (the regex implies something in quotes follows, but it's not in the example event), it's impossible to know if there is a better way to extract the field.