Building for the Splunk Platform

Extracting up to a particular string in rex

harshparikhxlrd
Path Finder

Here's what I have.

alt text

Basically, I'm trying to just get rid of the AddiontalInfo1 and AdditionalInfo2.

Here's the rex command I"m using: | rex field=Message "Message=\"(?.*)"

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Your regex tells Splunk to grab everything in the Message field. All you need to do is tell it to stop when it gets to "AdditionalInfo".

Try | rex field=Message "Message=\"(?<field>.*) Additional".

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\"" 
| eval Message=mvindex(split(Message,"\""),0)

No, REGEX. ( ^∀^)

0 Karma

jgbricker
Contributor

If you know you will consistently see the pattern
"Message: message is here which can include punctuation and random quotes AdditionalInfo1" then my approach would be to match on and extract what you know will always precede (Message: whitespace) and then what will be after what you want (AdditionalInfo1) to terminate the regex. Then simply extract everything between. You may need to just leave the field=Message off the rex command because that field's bounds may not be accurate.

I like regex101.com for testing the regex matching

Default for rex is to go against field=_raw so you don't need to specify field=Message

I would specify it only if I knew that what i wanted to extract was always inside that field with no exceptions. The specificity of the rex field is mainly for performance as it limits scope. Your example event is pretty small so probably not a big deal to do _raw.

Between the <> you can all the newly extracted field whatever
Ignore the \'s between <>, this was how I got it to display the field name in answers
You might be able to drop the escaping of : and =

|rex "Message:\s(?<\msg_detail>(.*))AdditionalInfo1="

0 Karma

TISKAR
Builder

Hi:

CAN YOU TRY THIS PLEASE:

| makeresults
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\""
| rex field=Message "Message: (?<Message>.*?)\" AdditionalInfo"
0 Karma

jpolvino
Builder

This may work for you:

| makeresults
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\""
| rex field=Message "Message: (?<subMessage>.*?)\" Additional"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your regex tells Splunk to grab everything in the Message field. All you need to do is tell it to stop when it gets to "AdditionalInfo".

Try | rex field=Message "Message=\"(?<field>.*) Additional".

---
If this reply helps you, Karma would be appreciated.
0 Karma

harshparikhxlrd
Path Finder

This was my issue. I also found that my other issue I had was a result of using the . operator.

| rex field=Message "Message=\"(?<msg>[\s\S]*)\" AdditionalInfo1"

The dot operator doesn't consider spaces, which was causing an issue in my data. Thank you though.

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...