topic Re: Extract multiple groups (rex), key/value pairs comma separated in Splunk Search

Extract multiple groups (rex), key/value pairs comma separated

ejwade — Thu, 26 Oct 2023 03:37:37 GMT

I'm looking for the regular expression wizards out there. I need to do a rex with two capture groups: one for name, and one for value. I plan to use the replace function, and throw everything else away but those two capture groups (e.g., "\1: \2").

Here are some sample events.

name="Building",value="Southwest",descendants_action="success",operation="OVERRIDE"
name="Building",value=["Northeast","Northwest"],descendants_action="failure",operation="OVERRIDE"
name="Building",value="Southeast",descendants_action="success",operation="OVERRIDE"
name="Building",value="Northwest"
name="Building",value="Northwest",operation="OVERRIDE"

So far I just have this.
^name=\"(.*)\",value=\[?(.*)\]?

Any ideas?

Re: Extract multiple groups (rex), key/value pairs comma separated

gcusello — Thu, 26 Oct 2023 06:27:19 GMT

Hi @ejwade,

you should already have these extractions because usually Splunk identifies the groups fieldname=fieldvalue.

Anyway, please try this regex:

name\=\"(?<name>[^\"]*)\",value\=\[*\"(?<values>[^\"]*)

that you can test at https://regex101.com/r/PEszES/1

Ciao.

Giuseppe

Re: Extract multiple groups (rex), key/value pairs comma separated

ITWhisperer — Thu, 26 Oct 2023 09:41:05 GMT

Try something along these lines

^name=\"([^\"]*)\",value=(\[([^\]]+)\]|\"[^\"]+\")(.*)

https://regex101.com/r/id6m8s/1