Having trouble with rex matching wildcards with escaped double quotes

weropitjpoerit — Thu, 20 Apr 2023 16:03:14 GMT

Hi there, I am having some trouble matching patterns from a search string using the rex command.

I will show the message I am trying to search on, as well as several rex statements that I am using to find and extract certain bits of data (denoted by asterisks) into fields that I use in a table statement. rex statements matching wildcards populated by digits works fine, but I'm not able to match and extract data matching asterisks when they are within quotes even if I escape them.

| search Message="Error in breakfast table *, table name \"*\". The quick brown fox jumped over the lazy dog. The maximum length of the \"*\" data is currently set to * hotdogs, but the bun length is * inches. Increase the maximum length of the \"*\" bun to at least * inches and retry.*"
| rex "Error in breakfast table (?<breakfast_table>\d+)" | rename breakfast_table as "BT"

| rex "table name \"(?<table_name>[^\"]*)\"" | rename table_name as "TN"
| rex "maximum length of the \"(?<max_bunlength>[^\"]*)\"" | rename max_bunlength as "MB"

| rex "data is currently set to (?<current_length>\d+)" | rename current_length as "Current Length"

I am able to pattern match correctly on asterisks because they just represent number values. I am having trouble with asterisks within double quotes. For example, a real message may show "AB" or "Z" but this line will not match it, even though I have confirmed on regex101 that it should be matching the letters AB or Z correctly -> | rex "table name \"(?<table_name>[^\"]*)\"" | rename table_name as "TN"

Any suggestions on this?

Re: Having trouble with rex matching wildcards with escaped double quotes

richgalloway — Thu, 20 Apr 2023 18:20:03 GMT

To help with rex questions we really need to see example data. Please share sanitized events.

Re: Having trouble with rex matching wildcards with escaped double quotes

weropitjpoerit — Thu, 20 Apr 2023 19:13:55 GMT

I can't share the _raw event I used but I can mention how I was able to solve this issue.

I went through the Extract New Fields process, highlighted the bit of information I needed like so -> \"author\", viewed the generated regex, opened it in search so I could see the full |rex command that was generated, and used that.

topic Having trouble with rex matching wildcards with escaped double quotes in Splunk Search

Having trouble with rex matching wildcards with escaped double quotes

Re: Having trouble with rex matching wildcards with escaped double quotes

Re: Having trouble with rex matching wildcards with escaped double quotes