topic Re: Extract a string from _raw in Splunk Search

How to extract a string from _raw?

avadhutha — Tue, 21 Mar 2023 16:22:18 GMT

I have a string like below and unable to extract accuratly with rex command please suggest any alternative way.

_raw----------------

{lable:harish,message: Say something, location:India, state:TS,qual:xyz}

{message: say nothing,lable:harish, location:India, state:TS,qual:xyz}

{lable:harish, location:India, state:TS,qual:xyz,message: say splunk splunk answers}

The message value is randomized location and I need to pick the message value.

When I try with below command it is not considering the proper end position. Please suggest

|rex "message:(?<Message_value>.*)[,|}]" |table Message_Value

ITWhisperer — Tue, 21 Mar 2023 12:14:28 GMT

Field names are case-sensitive, also, you are using a greedy match which may pick up more than you bargained for - try this

|rex "message:(?<Message_Value>.*?)[,|}]" |table Message_Value

avadhutha — Tue, 21 Mar 2023 12:19:17 GMT

Thank you so much.., I was trying a lot of thing like field extraction and regex and you helped it well with ?.