topic Rex not stopping capture after match in Splunk Search

Rex not stopping capture after match

ea-2023 — Thu, 22 Feb 2024 07:44:50 GMT

I'm not sure why rex is properly matching the beginning of the value I am looking for (NameofTeam), but it also matches and includes everything after it. As I understand it, my search should stop matching when it reaches "}, after matching the team name. What am I doing wrong?

index=test | rex field=_raw "Key\": \"Owner\", \"ValueString\": \"(?<Team>.+)\"},"

Sample Data:

{"Key": "OtherKey", "ValueString": "OtherValue"}, {"Key": "Owner", "ValueString": "NameofTeam"}, {"Key": "OtherKey", "ValueString": "OtherValue"},

Expected Output:

NameofTeam

Actual Output:

NameofTeam"}, {"Key": "OtherKey", "ValueString": "OtherValue"},

Re: Rex not stopping capture after match

richgalloway — Tue, 20 Feb 2024 01:42:42 GMT

The + quantifier is greedy, meaning it will match as many characters as possible. So you'll get everything from NameofTeam until the end of the data. To avoid that, use the non-greedy quantifier +?, even better, change the pattern to match until the next quotation mark.

index=test | rex field=_raw "Key\": \"Owner\", \"ValueString\": \"(?<Team>.+?)\"},"

index=test | rex field=_raw "Key\": \"Owner\", \"ValueString\": \"(?<Team>[^"]+)\"},"

Re: Rex not stopping capture after match

ea-2023 — Tue, 20 Feb 2024 18:33:08 GMT

The first one did end up working for me. The second one for whatever reason was throwing Error in 'SearchParser': Mismatched ']'. Not a big deal for me since the first one works, but figured I'd mention it.

| rex field=_raw "Key\": \"Owner\", \"ValueString\": \"(?<Owner>[^"])\"},"

The second one is what I thought I was doing... capturing everything until it saw "}, 🙂

Thank you for helping me with this!

Re: Rex not stopping capture after match

richgalloway — Wed, 21 Feb 2024 13:24:53 GMT

The second rex command probably needs additional escaping, but since the first works for you we'll leave it at that.

Re: Rex not stopping capture after match

kiran_panchavat — Wed, 21 Feb 2024 15:42:28 GMT

You can try this regex also :

"Key":\s*"Owner",\s*"ValueString":\s*"(?<Team_Name>[^"]*)"

Regex