topic Re: Rex help in Splunk Search

Rex help

smineo — Tue, 09 Jul 2024 23:42:44 GMT

Hi, I have a search result with the field message.log, and the field contains this example pattern

I'd like to rex "this-value-here" which is always preceded by the pattern pipe-space-pipe-space and always followed by pipe-space-SAML20.

Having trouble with the rex expression, appreciate the assistance.

Re: Rex help

richgalloway — Wed, 10 Jul 2024 00:18:50 GMT

I quick test in regex101.com produced this regular expression.

\| \|(?<value>[^\|]+)\| SAML20

Re: Rex help

inventsekar — Wed, 10 Jul 2024 00:57:30 GMT

Hi @smineo .. Rich's rex working perfectly..

Re: Rex help

smineo — Wed, 10 Jul 2024 02:32:54 GMT

Great, thanks. Could you tell me what you did there to get that?

Re: Rex help

richgalloway — Wed, 10 Jul 2024 12:29:10 GMT

It's simple, really, since we know what precedes and follows the desired field. Just put the known text into the regular expression and add a named capture group between them. The pattern for the capture group can be either a non-greedy match of anything (.*?) or match anything that is not what follows the field ([^\|]+).