How to extract from CSV using rex?

[batsonpm]

I have a csv file that I am trying to pull data from, this is an example of the data in the file:

Action, Message, Server Connection, Service Path, Service Acct, Source IP, Time, User
Retrieve password,126.259.193.138,(Action: Connect)(Connection to address: aservername01),Operating System-FHR-ServerAdmins-kochind.com-SVC_SVRACCESS_PROD_5,SVC_SVRACCESS_PROD_5,172.16.125.36,07/10/2018 15:45:41,Some.Guy@nowhere.com

My query where I am trying to pull just the server name, "aservername01" out of the file:

| inputlookup filename.csv 
| rex field=_raw "address: (?<Server>.*)"

It is not returning the "Server" field with any data. Is this because it is a csv file instead of a text file? What am I missing because I'm not getting any errors from Splunk.

Thank you!

[MuS · Accepted solution]

Hi batsonpm,

when using inputlookup you will not get a field called _raw, try using the header name for this column:

| rex field="Server Connection" "address: (?<Server>[^)]+)"

Also note the changed regex, since your would match everything after address:.

Hope this helps ...

cheers, MuS

[batsonpm]

Gah! I was so close! 🙂
I couldn't find any docs on how to explicitly use the ')' for rex since it was '[^)]' in regex, so I left it off to just get thru the first issue of actually getting data.

Thank you!