topic Re: How to use Regex to find values between two strings in Splunk Search

How to use Regex to find values between two strings

hartfoml — Mon, 11 Jul 2016 18:03:16 GMT

I have this event:

<f:Table><f:Row><f:Cell>IE Group Policy</f:Cell></f:Row><f:Row><f:Cell>HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols</f:Cell></f:Row><f:Row><f:Cell>Windows SChannel</f:Cell></f:Row><f:Row><f:Cell>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client\Enabled</f:Cell></f:Row><f:Row><f:Cell>IE</f:Cell></f:Row><f:Row><f:Cell>HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols</f:Cell></f:Row><f:Row><f:Cell>KB3009008</f:Cell></f:Row></f:Table>

and I have other events like this. I want to extract the information between the <f:Cell></f:Cell> in this event, there are several entries, but in most, there is only one entry. How can I get this to work in all cases?

Help With Regex Please

Re: How to use Regex to find values between two strings

skoelpin — Mon, 11 Jul 2016 18:06:37 GMT

Here ya go..

(?<=\<f\:Cell\>).*(?=\<\/f\:Cell\>)

If you're doing it at index time then it will look like this (?P<FieldName>(?<=\<f\:Cell\>).*(?=\<\/f\:Cell\>))

This uses a lookbehind to sink into and a lookahead to sink into <\f:Cell>

Re: How to use Regex to find values between two strings

sundareshr — Mon, 11 Jul 2016 18:07:07 GMT

Try this

... | rex max_match=0 "\<f\:Cell\>(?<cellvalue>[^\<]+)\<\/f\:Cell\>" | table cellvalue | mvexpand cellvalue | ...

Re: How to use Regex to find values between two strings

hartfoml — Mon, 11 Jul 2016 18:26:24 GMT

Thanks this works great

Re: How to use Regex to find values between two strings

maheshkk444 — Mon, 31 May 2021 16:12:30 GMT

There is single events which contains multiple conversationid:"conv_abc" workgroup, conversations:"conv_xyz" workgroup. I have to find all values between conversationid and workgroup which are in single event. I had tries one Rex but it giving content between first conversationid and last workgroup string