Splunk Dev

Extracting up to a particular string in rex

harshparikhxlrd
Path Finder

Here's what I have.

alt text

Basically, I'm trying to just get rid of the AddiontalInfo1 and AdditionalInfo2.

Here's the rex command I"m using: | rex field=Message "Message=\"(?.*)"

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Your regex tells Splunk to grab everything in the Message field. All you need to do is tell it to stop when it gets to "AdditionalInfo".

Try | rex field=Message "Message=\"(?<field>.*) Additional".

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\"" 
| eval Message=mvindex(split(Message,"\""),0)

No, REGEX. ( ^∀^)

0 Karma

jgbricker
Contributor

If you know you will consistently see the pattern
"Message: message is here which can include punctuation and random quotes AdditionalInfo1" then my approach would be to match on and extract what you know will always precede (Message: whitespace) and then what will be after what you want (AdditionalInfo1) to terminate the regex. Then simply extract everything between. You may need to just leave the field=Message off the rex command because that field's bounds may not be accurate.

I like regex101.com for testing the regex matching

Default for rex is to go against field=_raw so you don't need to specify field=Message

I would specify it only if I knew that what i wanted to extract was always inside that field with no exceptions. The specificity of the rex field is mainly for performance as it limits scope. Your example event is pretty small so probably not a big deal to do _raw.

Between the <> you can all the newly extracted field whatever
Ignore the \'s between <>, this was how I got it to display the field name in answers
You might be able to drop the escaping of : and =

|rex "Message:\s(?<\msg_detail>(.*))AdditionalInfo1="

0 Karma

TISKAR
Builder

Hi:

CAN YOU TRY THIS PLEASE:

| makeresults
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\""
| rex field=Message "Message: (?<Message>.*?)\" AdditionalInfo"
0 Karma

jpolvino
Builder

This may work for you:

| makeresults
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\""
| rex field=Message "Message: (?<subMessage>.*?)\" Additional"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your regex tells Splunk to grab everything in the Message field. All you need to do is tell it to stop when it gets to "AdditionalInfo".

Try | rex field=Message "Message=\"(?<field>.*) Additional".

---
If this reply helps you, Karma would be appreciated.
0 Karma

harshparikhxlrd
Path Finder

This was my issue. I also found that my other issue I had was a result of using the . operator.

| rex field=Message "Message=\"(?<msg>[\s\S]*)\" AdditionalInfo1"

The dot operator doesn't consider spaces, which was causing an issue in my data. Thank you though.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...