topic Re: Help extracting fields from raw event in Splunk Search

Help extracting fields from raw event

hippe21 — Wed, 29 Mar 2017 00:08:52 GMT

Here's what my raw event looks like:

58daf92d66c83d000e469dfd.txt unsupported file format

I'd like to extract the following below during a search, to pull these fields:

How can I accomplish this using Rex?

gjanders — Wed, 29 Mar 2017 07:49:36 GMT

Maybe something like:

| rex "(?P<task>^[^\.]+)(?P<fileExt>\S+\s(?P<errorReason>.*)"

I'm unsure if that first part should be [^.] or [^.]

The built in regular expression creator could help here or sites like https://regex101.com/

hippe21 — Wed, 29 Mar 2017 14:19:13 GMT

This is exactly what I needed, thank you!