Regular Expression

[silverKi]

I need to extract the Rule field using a regex in props.conf without using transforms.conf.

The regex I used was

Rule\:(?P<Rule>\s.*?(?=\")|((\s\w+)+)\-\w+\s\w+|\s.*?(?=\,))

Please let me know if you have any idea of ​​regular expression that satisfies all cases below to extract rule field by looking at the original data below.

Test-String

Dec 5 17:22:59 10.2.1.166 Dec 5 17:13:45 ICxxx SymantecServer: Nxxx,10.150.35.108,Continue,Application and Device Control is ready,System,Begin: 2022-12-05 17:13:18,End Time: 2022-12-05 17:13:18,Rule: Built-in rule,0,SysPlant,0,SysPlant,None,User Name: None,Domain Name: None,Action Type: ,File size (bytes): 0,Device ID:

Dec 5 17:22:59 10.2.1.166 Dec 5 17:12:45 ICxxx SymantecServer,10.10.232.76,Blocked,[AC7-2.1] 스크립트 차단 - Caller,End Time: 2024-12-05 16:41:09,Rule: 모든 응용 프로그램 | [AC7-2.1] 파일 및 폴더 액세스 시도,9056,C:/Windows/System32/svchost.exe,0,No Module Name,C:/Windows/System32/GroupPolicy/DataStore/0/SysVol/celltrion.com/Policies/{08716B68-6FB2-4C06-99B3-2685F9035E2E}/Machine/Scripts/Startup/start_dot3svc.bat,User Name: xxx,Domain Name: xxx,Action Type: ,File size (bytes): xx,Device ID: xxx\xx&Ven_NVMe&Prod_Skhynix_BC501_NV\5&974&0&000

Dec 5 17:22:59 10.2.1.166 Dec 5 17:13:06 IC01 SymantecServer: N1404002,10.50.248.13,Blocked,이 규칙은 모든 응용 프로그램이 시스템에 드라이브 문자를 추가하는 모든 USB 장치에 파일을 쓸 수 없도록 차단합니다. - File,Begin: 2024-12-05 16:33:53,End Time: 2024-12-05 16:33:53,"Rule: USB 드라이브에 읽기 허용,쓰기 차단 | [AC4-1.1] USB 드라이브에 읽기 허용,쓰기 차단",4032,C:/Program Files/Microsoft Office/xxx/Office16/EXCEL.EXE,0,No Module Name,D:/1. NBD/1. ADC cytotoxicity/2024-4Q/~$20241203-05 CT-P70 Drug release.xlsx,User Name: 1404002,Domain Name:xxx,Action Type: ,File size (bytes): 0,xx

extract string

Rule: Built-in rule 
Rule: 모든 응용 프로그램 | [AC7-2.1] 파일 및 폴더 액세스 시도
Rule: USB 드라이브에 읽기 허용,쓰기 차단 | [AC4-1.1] USB 드라이브에 읽기 허용,쓰기 차단

[silverKi · Accepted solution]

I solved the problem using REX 

(\"|)Rule:\s*(?P<Rule>.*?)(?:(\"))?\

[Aditi27]

Hi,

Can you try the following regex

Regex: Rule:\s(?P<Rule>(.*?)(?=,\d+))

It uses positive lookahead (?=) and captures everything until it finds "," followed by digit. If the end of the rule always has a digit then this will work. Keep in mind that if an word is replaced by digit at the end of the rule this will not work.

Please try and if it works an upvote is appreciated.

[richgalloway]

Positive lookahead doesn't perform well in Splunk and, generally, is unnecessary.

[ITWhisperer]

Try this expression

("|)Rule:\s*(?P<Rule>.*?)\1,\d

[richgalloway]

According to regex101.com, your regular expression works.  This one, however, is more efficient.

EXTRACT-Rule = (")?Rule:(?P<Rule>.*?)(?(1)\1|,)

It looks for a leading quotation mark and uses that as the terminating character (using (?(1)\1|,)).

[silverKi]

Can you explain the regular expression you used?