Archive

Regex Help

Path Finder

Hi,

I need a regex to extract at search time the values after ACTION[*] and up to the next character, regardless of whether its in quotes or not. So the values "100", or 'alter user blah identified by *' from the following examples;

ACTION:[3] "100" RETURNCODE:[1]
ACTION :[32] 'alter user scott identified by *' DATABASE

Thanks.

Tags (1)
0 Karma
1 Solution

Influencer

Hey

Try this

| rex field=_raw "ACTION\s\:\[\d+\]\s(?<YourFiledName>[\'|\"][^\'|\"]*[\'|\"])"

View solution in original post

0 Karma

Influencer

Hey

Try this

| rex field=_raw "ACTION\s\:\[\d+\]\s(?<YourFiledName>[\'|\"][^\'|\"]*[\'|\"])"

View solution in original post

0 Karma

Path Finder

It nearly worked, extracted out the 'alter user scott identified by *' ok, but I didnt get "100" back as a value...

0 Karma

Influencer

Yes, I missed a * in the first \s:

 | rex field=_raw "ACTION\s*\:\[\d+\]\s(?<YourFiledName>[\'|\"][^\'|\"]*[\'|\"])"
0 Karma

Path Finder

Awesommmmmmme.

Worked perfectly. Many thanks.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!