topic Re: rex expression in Splunk Search

rex expression

ajaysamantbms — Wed, 15 Jan 2014 21:43:53 GMT

one of my field contains one big string as shown below

params={fl=doc_objectid,score&sort=doc_dateeffective+asc,doc_number+asc&start=0&q=((doc_name:"pd\-dir\-0017\+\(005220\)"^72)+AND+(doc_version:"2.0"))+AND++doc_docbase:QDOC_PD_DOCS_MIG^0.00001+AND+doc_objecttype:document^0.00001&rows=500}

Using rex expression i wanted to extract the value of doc_name which is embedded inside the params field - the value is equal to whatever comes in till we hit )

sourcetype = abc.log | fields params | rex "doc_name:<?mydocname>[]+\ - i tried this - its not working..wanted to extract it in mydocname and sort by that field

Re: rex expression

bandit — Wed, 15 Jan 2014 22:19:03 GMT

Does this work?

| rex "doc_name:\"(?<mydocname>[^+]+)"

You may also need to specify the field for the rex if it not coming from _raw like so.

| rex field=params "doc_name:\"(?<mydocname>[^+]+)"

Re: rex expression

ajaysamantbms — Thu, 16 Jan 2014 15:17:33 GMT

thanks it works for me..i could tweak it to change the field delimiter...thanks

Re: rex expression

arihant16cse — Thu, 07 Feb 2019 04:56:07 GMT

please check it and it works on my machine

| rex field=params ".((\w+:\"(?.)\"^.*"

Re: rex expression

arihant16cse — Thu, 07 Feb 2019 05:07:39 GMT

| rex field=_raw ".((\w+:\"(?.)\"^.*"

please try it......it is not hard coded......

Re: rex expression

1206chandra — Thu, 07 Feb 2019 10:35:24 GMT

| rex field=params ".((\w+:\"(?.)\"^.*"