topic Re: Help with Rex Field Extraction in Splunk Search

Help with Rex Field Extraction

scout29 — Thu, 09 Nov 2023 03:24:02 GMT

I am trying to write a rex command that extracts the field "registrar" from the below four event examples. The below values in bold are what i am looking for to be the value for "registrar". I am using the following regex to extract the field and values, but i seem to be capturing the \r\n after the bold values as well. How can i modify my regex to capture just the company name in bold leading up to \r\n Registrar IANA

Current regex being used: Registrar:\s(?<registrar>.*?) Registrar IANA

Expiry Date: 2026-12-09T15:18:58Z\r\n Registrar: ABC Holdings, Inc.\r\n Registrar IANA ID: 972

Expiry Date: 2026-12-09T15:18:58Z\r\n Registrar: Gamer.com, LLC\r\n Registrar IANA ID: 837

Expiry Date: 2026-12-09T15:18:59Z\r\n Registrar: NoCo MFR Ltd.\r\n Registrar IANA ID: 756

Expiry Date: 2026-12-09T15:18:59Z\r\n Registrar: Onetrust Group, INC\r\n Registrar IANA ID: 478

Re: Help with Rex Field Extraction

bowesmana — Thu, 09 Nov 2023 03:48:06 GMT

Add in the \r\n to the regex, i.e.

| rex "Registrar:\s(?<registrar>.*?)\\\r\\\n Registrar IANA"

Note 3 slashes

I assume those \r\n are literal characters rather than CR/LF?

Re: Help with Rex Field Extraction

gcusello — Thu, 09 Nov 2023 07:08:21 GMT

Hi @scout29 ,

please try this:

| rex "Registrar:\s+(?<Registrar>[^\\]*)"

that you can test at https://regex101.com/r/7PdpcJ/1

If it doesn't run on Splunk use three backslashes in the square parenthesis (sometimes Splunk is strange in regex extractions!).

Ciao.

Giuseppe

Re: Help with Rex Field Extraction

gcusello — Mon, 13 Nov 2023 14:18:29 GMT

Hi @scout29 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉