topic Re: How to create regex that will pick up on a value contained in [ ] brackets? in Splunk Search

How to create regex that will pick up on a value contained in [ ] brackets?

Splunky21 — Wed, 16 Nov 2022 18:59:39 GMT

Hi all,

I'm attempting to develop a regex that will pick up on a value contained in [ ] brackets (see below):

Log value

year number time:time:time 00 AAA0 Blah Blah Blah Blah Blah: [X] to [Y] (4 possible variables X,Y,A,B)

I need to alert every time the * to [ bracketed value] changes. Trying to make a regex to pick out these bracketed values. Any help is appreciated!

Re: How to create regex that will pick up on a value contained in [ ] brackets?

richgalloway — Wed, 16 Nov 2022 19:39:08 GMT

Try this command to extract both values within brackets.

| rex "\[(?<bracket1>[^\]]+)\] to \[(?<bracket2>[^\]]+)"

It looks for the first bracket, extracts everything up to the second into field 'bracket1', then it looks for a closing bracket followed by " to " and a third bracket. Everything up to the fourth bracket is put into field 'bracket2'.

Re: How to create regex that will pick up on a value contained in [ ] brackets?

Splunky21 — Wed, 16 Nov 2022 21:15:49 GMT

That worked perfectly, thanks! 🙂