topic Re: Excluding multiple slashes throughout regex capture string in Splunk Search

Excluding multiple slashes throughout regex capture string

splunkrush — Fri, 22 Mar 2024 13:31:27 GMT

Trying to figure out how to extract a field using regex to capture the entire string. Only problem is there are a bunch of slashes throughout. Sometimes one, sometimes 3, etc. I've tried variations of commands I found in the documentation but no luck. is this possible?

Example String of Field I want to extract with all the context appended to one another minus the slashes:

\"\\\"Field1\\\":\"context"\\\",\\\:"\"context"\\\",\\\:"\"context"\\\",\\\:"\"context"\\\",\\\:"\"context"\\\"context\\\\\\\context\\\\\\\\Field2

Want it to be extracted like this: Field1="context","context" etc so slashes are eliminated. Appreciate any help.

Re: Excluding multiple slashes throughout regex capture string

ITWhisperer — Fri, 22 Mar 2024 13:46:04 GMT

You can simply remove the backslashes like this

| rex field=_raw mode=sed "s/\\\//g"

However, I suspect this is not what you want, but what you want it unclear since all your data is "context". Are you expecting Field1 to be "context,context,context", or something else?

Re: Excluding multiple slashes throughout regex capture string

splunkrush — Fri, 22 Mar 2024 14:00:11 GMT

Thank you, that did the trick. I was trying to do everything through the field extraction page, but using 'sed' worked better. It kept all the context I needed and eliminated all the slashes.