topic Re: Using rex to find matching values. in Splunk Search

Using rex to find matching values.

veera9 — Thu, 31 Aug 2017 13:33:21 GMT

I have the following
ACTION :[7] 'CONNECT'
DATABASE[1] 'SYSTEM'

That's in the _raw data.
How do I extract CONNECT and SYSTEM under headers ACTION and DATABASE?

gcusello — Thu, 31 Aug 2017 14:00:43 GMT

Hi veera9,
Try this

ACTION\s:\[\d\]\s\'(?<ACTION>[^\']*)\'\s+DATABASE\[\d+\]\s\'(?<DATABASE>[^\']*)\'

Bye.
Giuseppe

DalJeanis — Thu, 31 Aug 2017 23:56:10 GMT

That would be

 | rex "ACTION\s:\[\d\]\s\'(?<ACTION>[^\']*)\'\s+DATABASE\[\d+\]\s\'(?<DATABASE>[^\']*)\'"

The above works fine. Based on your example breaking across lines, I might go with

 | rex "ACTION\s:\[\d\]\s\'(?<ACTION>[^\']*)\'"
 | rex "DATABASE\[\d+\]\s\'(?<DATABASE>[^\']*)\'"

...or...

 | rex "ACTION\s:\[\d\]\s\'(?<ACTION>[^\']*)\'|DATABASE\[\d+\]\s\'(?<DATABASE>[^\']*)\'" max_match=0

Any of the above should work.

veera9 — Sun, 24 Sep 2017 00:39:46 GMT

Thank you everyone.

gcusello — Sun, 24 Sep 2017 07:59:24 GMT

If you're satisfied, please accept or upvote this answer.
Bye.
Giuseppe