topic Re: How to extract a field using rex that contains backslash and double quotation marks in Splunk Search

How to extract a field using rex that contains backslash and double quotation marks?

retro-bloke — Fri, 09 Dec 2022 19:49:54 GMT

in the raw event there is a line that goes Brand\="xyz"

What's the rex command I can use to extract this in my search?

If possible, I'd like to remove the \ and "" from the extraction itself.

inventsekar — Fri, 09 Dec 2022 00:47:07 GMT

Hi @retro-bloke ... May i know if you are looking for a rex search query

or..

you want to update the props.conf file for the purpose of field extraction, please confirm, thanks.

retro-bloke — Fri, 09 Dec 2022 00:48:37 GMT

Hi @inventsekar, I am looking for a rex search query

inventsekar — Fri, 09 Dec 2022 01:11:47 GMT

Please check this: (you may need to modify little bit, depending on your logs.. if this does not work, pls give us some sample events)

| makeresults | eval temp="the test event is Brand\=\"xyz\"" |rex field=temp "(?P<brand>\w+)\"" |table temp brand

retro-bloke — Fri, 09 Dec 2022 04:17:43 GMT

I found that this also works

rex "Brand\\\=\"(?<brand>.*?)\""

the triple quotation marks escape the \, the \" surrounding the () handles the quotation marks in the event itself.