topic regular express to stop at "=" in Splunk Search

regular express to stop at "="

wuming79 — Wed, 24 May 2017 07:26:21 GMT

Hi, I have a search string that does the following:

temperature sourcetype=kaa | rex field=_raw "\"endpointKeyHash\":{\"string\":\"(?[^\"])\".\"Event\": (?{.*})$" | spath input=mydata | table _time, temperature, endpoint

The results will have 3 columns as _time, endpoint, temperature.
Under endpoint, it will reflect something like MASHjkasdhfa=.

I wanted to extract just MASHjkasdhfa but I can't do it with (?[^=]*)? How should I phrase it?

Re: regular express to stop at "="

harshal_chakran — Wed, 24 May 2017 08:38:27 GMT

Use following rex to extract text before "=" symbol

|rex field=endpoint "(?<extracted_endpoint>.+?)="

Try using regex101 for generating rex in future

Re: regular express to stop at "="

gcusello — Wed, 24 May 2017 08:38:54 GMT

Hi wuming79,
sorry, could you share an example of your logs?
in addition could you format as Code Sample you regex, because isn't readable.

Bye.
Giuseppe

Re: regular express to stop at "="

wuming79 — Wed, 24 May 2017 09:36:06 GMT

Hi,

The log is in this format under _raw field. Sorry, how do I paste it as Code Sample?

2641328 [EPS-log-dispatcher-11] INFO 1.24978294676695149906 - {"Log Header": "{"endpointKeyHash":{"string":"MAz7MadOhr02tPt5vtZsSEy9FWw="},"applicationToken":{"string":"24978294676695149906"},"headerVersion":{"int":1},"timestamp":{"long":1495594584490},"logSchemaVersion":{"int":2}}","Event":{"temperature":-1,"timeStamp":1495594583638}}

Re: regular express to stop at "="

wuming79 — Tue, 29 Sep 2020 14:11:26 GMT

Not sure why my original question was not updated. I need to correct my search string which is

temperature sourcetype=kaa_file | rex field=_raw "\"endpointKeyHash\":{\"string\":\"(?[^\"])\".\"Event\": (?{.*})$" | spath input=mydata | table _time, temperature, endpoint

I tried replacing "(?[^\"]*) with "(?.+?)=" and it works. But what does .+?)= means? I thought everything that I wanted to extract should be within the ( )?

Re: regular express to stop at "="

gcusello — Wed, 24 May 2017 10:05:34 GMT

Hi wuming79,
if I correctly understand: you want to extract the string between double quotes after endpointKeyHash and String, correct?

if this is your need, your regex is

endpointKeyHash\":\{\"string\":\"(?<endpointKeyHash>[^\=\"]*)

you can test it at https://regex101.com/r/rbE3YH/1

When you insert a regex in a message, you have to select it and click on the "Code Sample" button (the one with 101010 numbers): in this way it's possible to see special characters.

Bye.
Giuseppe

Re: regular express to stop at "="

damiensurat — Wed, 24 May 2017 13:58:57 GMT

Go to regex101.com and enter your string and the regex. It will tell you exactly what each of the different symbols are doing on the right hand side of the extraction. Cheers.

Re: regular express to stop at "="

woodcock — Wed, 24 May 2017 14:33:47 GMT

You are probably using .* to capture the field, switch this to [^=]* instead.

Re: regular express to stop at "="

wuming79 — Fri, 26 May 2017 03:26:58 GMT

Thanks Giuseppe. I got it now.