topic Re: Rex Question in Splunk Search

Rex Question

subtrakt — Mon, 17 Aug 2015 13:21:18 GMT

rex "(?i)(?P<testERROR>(\:[^\:]*){2})$"

output

:test string 123:test test test123

I have to keep the the 2nd : match from the end of the line but i don't want it to be displayed in the output.

*when i say second match from the end, that means i would like to remove the colon from ":test"

Is this something where a lookahead/lookbehind is needed?

Re: Rex Question

diogofgm — Mon, 17 Aug 2015 13:50:40 GMT

is ":test string 123:test test test123" the string you want to use that regex?
if it is, you are capturing 2 groups

group "testERROR" - :test string 123:test test test123
unnamed group - :test test test123

what do you want to capture? this? "test test test123"

use https://regex101.com to test your regex

Re: Rex Question

subtrakt — Mon, 17 Aug 2015 13:56:44 GMT

test string 123:test test test123
this is what i want to capture.

Re: Rex Question

diogofgm — Mon, 17 Aug 2015 14:00:49 GMT

try this:

 ^:(?P<error>.*)$

if the complete string you're looking at is ":test string 123:test test test123" and you just want to remove the ":" this works.

Re: Rex Question

woodcock — Mon, 17 Aug 2015 16:02:07 GMT

If you are asking how to capture everything after the next-to-last colon (through the end of the line) but don't include the next-to-last colon, then do it like this:

... | rex ":(?<testERROR>[^:]*:[^:]*$)"

Re: Rex Question

subtrakt — Tue, 18 Aug 2015 20:43:00 GMT

I guess the quantifier wasn't needed. Thanks Woodcock!

Re: Rex Question

woodcock — Wed, 19 Aug 2015 01:09:09 GMT

If this worked, do click "Accept" to close the question.