topic Re: Regex in Splunk Search

Regex- Help with extracting field

Dayalss — Thu, 23 Mar 2023 14:47:04 GMT

Can someone please help me in extracting the field Specific_DL_Testing from the below sample log.

instance of the "\Specific_DL_Testing" task.

The output should be Specific_DL_Testing

Re: Regex

ITWhisperer — Thu, 23 Mar 2023 08:08:17 GMT

| rex "instance of the \"\\(?<task>[^\"]+)\" task."

Re: Regex

Dayalss — Thu, 23 Mar 2023 08:12:38 GMT

Getting error :- Error in 'rex' command: Encountered the following error while compiling the regex '\instance of the "\(?<task>[^"]+)" task.': Regex: unrecognized character follows \.

Re: Regex

ITWhisperer — Thu, 23 Mar 2023 08:33:46 GMT

I missed a backslash

| rex "instance of the \"\\\(?<task>[^\"]+)\" task."

Re: Regex

Dayalss — Thu, 23 Mar 2023 08:37:10 GMT

I have used the above expression but its not extracting the field.

Re: Regex

ITWhisperer — Thu, 23 Mar 2023 08:43:21 GMT

Here is a runanywhere example of it working

| makeresults | eval _raw="instance of the \"\\Specific_DL_Testing\" task." | rex "instance of the \"\\\(?<task>[^\"]+)\" task."

If it is not working for you, please provide example events and the SPL you are using (preferably in code blocks </> like the example above to prevent information being lost due to formatting

Re: Regex

Dayalss — Thu, 23 Mar 2023 09:33:47 GMT

Task Scheduler terminated "{8878FDRGSGS-8cde-1234-123456789}" instance of the "\Specific_DL_Testing" task.

Please try on this event

Re: Regex

ITWhisperer — Thu, 23 Mar 2023 09:37:04 GMT

| makeresults | eval _raw="Task Scheduler terminated \"{8878FDRGSGS-8cde-1234-123456789}\" instance of the \"\\Specific_DL_Testing\" task." | rex "instance of the \"\\\(?<task>[^\"]+)\" task."

Re: Regex

Dayalss — Thu, 23 Mar 2023 09:56:32 GMT

I see you are checking for "\\Specific_DL_Testing\"

Can you try for "\Specific_DL_Testing\"

Re: Regex

ITWhisperer — Thu, 23 Mar 2023 10:02:54 GMT

I am not checking for "\\Specific_DL_Testing\" - this is part of the eval command to create the sample _raw field in line with what you say is your event

As you can see from the _raw field in the screenshot, the event matches what you said you event was.