topic Re: How do I edit the syntax for my rex expression to extract the field from my sample data? in Splunk Search

How do I edit the syntax for my rex expression to extract the field from my sample data?

rgcox1 — Tue, 13 Oct 2015 21:09:27 GMT

Can't get the following to work:

rex field=updateTitle  "(?<patch>)KB\d*+"

Sample text:

Security Update for Lync 2010 X64 (KB3081087â€‹)
Security Update for Microsoft Office 2010 (KB3054965) 32-Bit Edition
Update for Microsoft Office 2010 (KB3055042) 32-Bit Edition
Windows Malicious Software Removal Tool x64 - September 2015 (KB890830)
Update for Microsoft PowerPoint 2010 (KB3085513) 32-Bit Edition
Update for Microsoft Office 2010 (KB3055047) 32-Bit Edition
Security Update for Microsoft .NET Framework 4.5, 4.5.1 and 4.5.2 on Windows 7, Vista, Server 2008, Server 2008 R2 x64 (KB3074550)

Re: How do I edit the syntax for my rex expression to extract the field from my sample data?

somesoni2 — Tue, 13 Oct 2015 21:13:49 GMT

Try like this

rex field=updateTitle "(?<patch>KB\d+)"

rex field=updateTitle "((?KB\d+)"

Re: How do I edit the syntax for my rex expression to extract the field from my sample data?

rgcox1 — Tue, 13 Oct 2015 21:32:05 GMT

Thx. Moving closing paren to end worked:

 rex field=updateTitle  "(?<KBnum>KB\d*+)"