Archive

Regex Help

jacqu3sy
Path Finder

Hi,

I need a regex to extract at search time the values after ACTION[*] and up to the next character, regardless of whether its in quotes or not. So the values "100", or 'alter user blah identified by *' from the following examples;

ACTION:[3] "100" RETURNCODE:[1]
ACTION :[32] 'alter user scott identified by *' DATABASE

Thanks.

Tags (1)
0 Karma
1 Solution

tiagofbmm
Influencer

Hey

Try this

| rex field=_raw "ACTION\s\:\[\d+\]\s(?<YourFiledName>[\'|\"][^\'|\"]*[\'|\"])"

View solution in original post

0 Karma

tiagofbmm
Influencer

Hey

Try this

| rex field=_raw "ACTION\s\:\[\d+\]\s(?<YourFiledName>[\'|\"][^\'|\"]*[\'|\"])"

View solution in original post

0 Karma

jacqu3sy
Path Finder

It nearly worked, extracted out the 'alter user scott identified by *' ok, but I didnt get "100" back as a value...

0 Karma

tiagofbmm
Influencer

Yes, I missed a * in the first \s:

 | rex field=_raw "ACTION\s*\:\[\d+\]\s(?<YourFiledName>[\'|\"][^\'|\"]*[\'|\"])"
0 Karma

jacqu3sy
Path Finder

Awesommmmmmme.

Worked perfectly. Many thanks.

0 Karma