need to trim search result from left till occurange of PulseSecure: and get everything after that

[aliasgar215]

Need to trim search result from left till occurange of PulseSecure: and get everything after that. Note post PulseSecure: line length and character may vary. Charcter is mix or alfabet, number, special characters etc

Sample:-

Dec 27 06:29:37 AAAAAA PulseSecure: 2021-12-27 06:29:37 - AAAAAA  - [110.1.1.1] Default Network::aa.aa.aa(AAA_BBB)[BB_CC_EEE]

I need result as below to be saved in field Extracted

2021-12-27 06:29:37 - AAAAAA  - [110.1.1.1] Default Network::aa.aa.aa(AAA_BBB)[BB_CC_EEE]

[ITWhisperer]

| rex "PulseSecure: (?<Extracted>.*)"

[aliasgar215]

i have to extract from field _raw the string portion after PulseSecure: till end of the log

[inventsekar]

i have to extract from field _raw the string portion after PulseSecure: till end of the log

Pls run this and update us what result you get:

yourbasesearch | rex field=_raw "PulseSecure: (?<Extracted>.*)" | table Extracted

[aliasgar215]

still not working, the extracted field is empty

[inventsekar]

Hi @aliasgar215 ..
this is a basic rex and there is no way that this can go wrong. so you are doing some simple mistakes, you should reply some sample messages and your complete search query, then only this can be troubleshooted. hope you understand, thanks. 

[aliasgar215]

Extracted column came empty not working

[ITWhisperer]

Here is an example in regex101.com showing it working - the test string is the string you provided - if this does not match your actual events, please provide more examples

https://regex101.com/r/PnGp13/1 

[aliasgar215]

my data is un _raw field, so to copy my data with your filter to extracted field, is any thing missing in below syntax.

| rex "PulseSecure (?<Extracted>.*)"

[scelikok]

Hi @aliasgar215,

You have missing : after PulseSecure,  could you please try below? Maybe there are nonprintable characters after :

| rex "PulseSecure:\s+(?<Extracted>.*)"

[aliasgar215]

still same, not working

[ITWhisperer]

Please can you share more events in a code block </> so we can try to see what might be different

[ITWhisperer]

| rex field=un_raw "PulseSecure: (?<Extracted>.*)"