topic Re: Incorrect Regex in Splunk Search

Incorrect Regex

IRHM73 — Wed, 25 Nov 2015 10:53:09 GMT

Hi, I wonder whether someone may be able to help me please.

I've created this regex \"Surname\\":\\"(?<SName>[^"]+)\\" which extracts the Surname from the following raw data:

"Surname\":\"SMITH\"

This works fine in Regex101, but I when I add this to my query here:

auditSource=tamc auditType=OutboundCall | rex field=_raw "\"Surname\\":\\"(?<SName>[^"]+)\\""

I receive the following error:

Mismatched ']'.

I just wondered whether someone may be able to look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

stephanefotso — Wed, 25 Nov 2015 11:26:58 GMT

Hello try this: auditSource=tamc auditType=OutboundCall | rex field=_raw "\"Surname\":\"(?[^\"]+)\""

IRHM73 — Wed, 25 Nov 2015 11:34:19 GMT

Hi thank you for coming back to me with this, but unfortunately I still receive the same error.

I'm able to get past the error using rex field=_raw "\"Surname\":\"(?[^\"]+)\"" but it is not extracting any information.

Kind Regards

Chris

woodcock — Wed, 25 Nov 2015 14:10:05 GMT

Like this:

"Surname":"(?<SName>[^"]+)"

And this:

auditSource=tamc auditType=OutboundCall | rex field=_raw "\"Surname\":\"(?<SName>[^\"]+)\""

IRHM73 — Wed, 25 Nov 2015 14:19:53 GMT

Hi @woodcock thank you for coming back to me with the solution.

Kind regards

Chris