topic Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)? in Splunk Search

rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)?

sabithanitg — Fri, 24 Apr 2015 13:54:30 GMT

rex command to extract fields from Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............
Marked with bold text are common in all the values.

result of field names should look like this.

DocumentNum=Document 345
DocumentType = Microsoft Word Text
username=first.last
device=abc1234
location=some text

I have started with following rex command, but I cannot look for the text till "owned by" and for user name "owned by" to "on" and so on

| rex Message="(?[^\,])\,(?[()?:owned]*)" | table DocumentNum DocumentType

my result is looking like this: DocumentNum = Document 345
DocumentType = Micro

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)?

stephanefotso — Fri, 24 Apr 2015 14:28:42 GMT

Hello! Here you go

|rex "^Message=(?P<DocumentNum>[^,]+),\s+(?P<DocumentType>\w+\s+\w+\s+\w+)(?:[^ \n]* ){3}(?P<username>[^ ]+) on (?P<device>[a-f0-9]+) was (?P<location>.+)"|table  DocumentNum,DocumentType, username, device, location

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)?

sabithanitg — Fri, 24 Apr 2015 14:53:20 GMT

Thanks for the answer Stephane, This is not showing up any value for these fields. Is there any other method to achieve this?

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)?

stephanefotso — Fri, 24 Apr 2015 15:04:29 GMT

try this:

    ..........|rex "^Message=(?P<DocumentNum>[^,]+),\s+(?P<DocumentType>\w+\s+\w+\s+\w+)\sowned\sby\s(?P<username>[^ ]+)\son\s(?P<device>[a-f0-9]+)\swas\s(?P<location>.+)"|table  DocumentNum,DocumentType, username, device, location

And if you are working with a csv file, means Message is a field in your csv, try this:

       ..........|rex field=Message "(?P<DocumentNum>[^,]+),\s+(?P<DocumentType>\w+\s+\w+\s+\w+)\sowned\sby\s(?P<username>[^ ]+)\son\s(?P<device>[a-f0-9]+)\swas\s(?P<location>.+)"|table  DocumentNum,DocumentType, username, device, location

if not working also, please let me see the entire first line of your events.

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)?

sabithanitg — Fri, 24 Apr 2015 17:34:47 GMT

Thanks stephane, With few changes it is working to extract for few values not all of them.
Is there any possibility of extracting all.

For example DocumentType field value contains as below similarly for Location
Microsoft Outlook - Memo Style,
11-02-099.pdf,
https://h44444.www3.hp.com/HPCSN/EtFOnline/fff_ff_notes

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)?

stephanefotso — Fri, 24 Apr 2015 20:20:51 GMT

yes of course! there are many possibilities to extract what you want. Please which of the above queries worked?
If it is the first one, here you go now:

|rex  "^Message=(?P<DocumentNum>[^,]+),(?P<DocumentType>[^\n]*)owned\sby\s(?P<username>[^ ]+)\s+on\s+(?P<device>[a-f0-9]+)\s+was\s+(?P<location>[^\n]*)"|table DocumentNum DocumentType, username ,device, location

if it is the second one, here you go

|rex field=Message "(?P<DocumentNum>[^,]+),(?P<DocumentType>[^\n]*)owned\sby\s(?P<username>[^ ]+)\s+on\s+(?P<device>[a-f0-9]+)\s+was\s+(?P<location>[^\n]*)"|table DocumentNum DocumentType, username ,device, location

Hope it may help now.

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)?

sabithanitg — Sun, 26 Apr 2015 04:06:37 GMT

I am using the first one.It worked perfectly.
Thank you very much and appreciate your help.

topic Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text **owned by** first.last **on** abc1234 **was** some text **on** some text.............)? in Splunk Search

rex command to extract fields from field( Message=Document 345, Microsoft Word Text **owned by** first.last **on** abc1234 **was** some text **on** some text.............)?

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text **owned by** first.last **on** abc1234 **was** some text **on** some text.............)?

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text **owned by** first.last **on** abc1234 **was** some text **on** some text.............)?

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text **owned by** first.last **on** abc1234 **was** some text **on** some text.............)?

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text **owned by** first.last **on** abc1234 **was** some text **on** some text.............)?

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text **owned by** first.last **on** abc1234 **was** some text **on** some text.............)?

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text **owned by** first.last **on** abc1234 **was** some text **on** some text.............)?

topic Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)? in Splunk Search

rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)?

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)?

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)?

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)?

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)?

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)?

Re: rex command to extract fields from field( Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............)?