topic Re: Extraction using regular expressions in Splunk Search

Extraction using regular expressions

honobe — Wed, 26 Jul 2017 09:52:04 GMT

I want to extract a character string using a regular expression.

I am considering extracting the field (message ID) using the rex command, but I can not extract it with regular expressions.

Message ID = '<　xxxxxxxx>'

※I want to extract characters between ｢'<｣ and　｢>'｣
※There is no space in the actual log.

I want to extract xxxxxxxx and make the field of message ID have the following form.

Message ID = xxxxxxxx

What kind of regular expression can I use to extract xxxxxxxx?

niketn — Wed, 26 Jul 2017 10:29:58 GMT

Try the following run-anywhere example.

| makeresults 
| eval _raw = "Message ID = '<　xxxxxxxx>'"
| rex field=_raw "Message ID = '<(?<MessageID>[^>]+)>'"

You can test the rex with your sample events. Eventually, create a Field Extraction Knowledge Object for the same.

MuS — Wed, 26 Jul 2017 10:34:51 GMT

Hi honobe,

based on the provided information this regex:

 '<(?<Message_ID>[^>]+)>'

will match everything between '< and >' and use the match in the new field called Message_ID.

This is a really basic example and can be optimised but I hope it helps to get you started ...

btw don't use field names with spaces 😉

cheers, MuS

MuS — Wed, 26 Jul 2017 10:37:56 GMT

typing too slow...again

Just a little tip: there is actually no need to escape the > inside of the [...] it will also work without the escaping

honobe — Wed, 26 Jul 2017 11:38:58 GMT

Thank you very much.
Thanks to your answer, I was able to solve the problem.

honobe — Wed, 26 Jul 2017 11:39:34 GMT

Thank you very much.
Thanks to your answer, I was able to solve the problem.

niketn — Wed, 26 Jul 2017 11:49:00 GMT

Thanks @Mus, I have corrected. But \ in regular expression also tells match exactly. It works either way, I missed removing it.