topic Re: Rex to Exclude + Sign in Splunk Search

Rex to Exclude + Sign

IRHM73 — Fri, 27 Nov 2015 06:59:12 GMT

I wonder whether someone may be able to help me please.

I'm trying to extract the text "Comapred to previous years almost a pleasure to use" from the raw data as shown below

feedback-comments=Compared+to+previous+years+almost+a+pleasure+to+use&isJavascript

I've tried the following regex, which does extract the text but this includes the '+' sign.

feedback-comments=(?<comments>[^[]+)\&isJavascript

Could someone possibly tell me please how I would be able to write this so the '+' signs are excluded.

Many thanks and kind regards

Chris

Re: Rex to Exclude + Sign

gcato — Fri, 27 Nov 2015 09:39:59 GMT

You can use the rex command in sed mode. Here's a run anywhere example

|stats c as feedback-comments |eval feedback-comments="Compared+to+previous+years+almost+a+pleasure+to+use&isJavascript"
| rex field="feedback-comments" "(?<comments>[^&]+)" |rex mode=sed field="comments" "s/\+/ /g"

Hope this helps.

Re: Rex to Exclude + Sign

IRHM73 — Fri, 27 Nov 2015 10:19:27 GMT

Hi @gcato thank you for this, but unfortunately this doesn't extract any of the information.

Kind Regards

Chris

Re: Rex to Exclude + Sign

richgalloway — Fri, 27 Nov 2015 13:36:45 GMT

@gcato's answer works for me. You only need the rex commands in your search. If it's not doing what you expect then please clarify your needs. For instance, to eliminate plus signs instead of replacing them with spaces use rex mode=sed field="comments" "s/\+//g".

Re: Rex to Exclude + Sign

IRHM73 — Fri, 27 Nov 2015 14:38:41 GMT

Ah that was it, thank you for coming back to me with this.

Kind Regards

Chris

Re: Rex to Exclude + Sign

richgalloway — Fri, 27 Nov 2015 15:08:47 GMT

If your problem is solved, please accept the answer.

Re: Rex to Exclude + Sign

chrisprodger — Sun, 29 Nov 2015 15:42:05 GMT

Hi gcato, if you would like to change your comment to an answer I can accept this for you.

Many thanks and kind regards

Chris