topic Re: How to use rex to extract field before two symbols in Splunk Search

How to use rex to extract field before two symbols

adamsobczykhsbc — Tue, 13 Feb 2024 13:29:22 GMT

I have raw data like:

Error=REQUEST ERROR | request is not valid.|","time":"1707622073040"

and I want to extract "REQUEST ERROR | request is not valid." to a new field, so I try to use rex to match until |" with below query but it still only returns "REQUEST ERROR"

|rex field=_raw "Error\=(?<ErrDesc>[^|\"]+)"

Re: How to use rex to extract field before two symbols

gcusello — Tue, 13 Feb 2024 13:38:26 GMT

Hi @adamsobczykhsbc,

please try this:

| rex "Error\=(?<ErrDesc>[^\|]+\|[^\|]+)"

that you can test at https://regex101.com/r/mIlDeU/1

Ciao.

Giuseppe

Re: How to use rex to extract field before two symbols

adamsobczykhsbc — Tue, 13 Feb 2024 13:43:04 GMT

Hi @gcusello , it works for that specific case, however my extracted field ErrDesc will not always have pipe "|" inside, basically I want to match anything until |" , no matter if pipe is in the field or not

Re: How to use rex to extract field before two symbols

gcusello — Tue, 13 Feb 2024 13:51:52 GMT

Hi @adamsobczykhsbc,

could you share some sample of your logs (both cases)?.

Ciao.

Giuseppe

Re: How to use rex to extract field before two symbols

adamsobczykhsbc — Tue, 13 Feb 2024 14:00:06 GMT

I just figured it out with guidance from https://stackoverflow.com/questions/7124778/how-can-i-match-anything-up-until-this-sequence-of-characters-in-a-regular-exp

correct rex will be

|rex field=_raw "Error\=(?<ErrDesc>.+?(?=\|\"))"

thanks for help!

Re: How to use rex to extract field before two symbols

gcusello — Tue, 13 Feb 2024 14:31:44 GMT

Hi @adamsobczykhsbc ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉