Security

I have a search query i like to understand what how regex field extraction is done for source in below query

chandra61446
New Member

I have a search query i like to understand what how regex field extraction is done for source in below query

Index= * "Error - [ServerError] ValidateMailDatabase: Database is not FT-indexed" | rex field=source "Policy\\\\+(?.*)\\\\" | rex field=source "Email\\\\+(?.*)\\\\"
Tags (2)
0 Karma

nickhills
Ultra Champion

Ok, So i would "think" that the intent of the regex is to look at the source of the data, and extract from that either a policy or email value (possibly both) however, the syntax for an inline rex expression is wrong!

I am assuming that the source of these logs is something like:
e:\logs\policy\MyPolicy\somelog.log
or
e:\logs\Email\your.name@email\somelog.log

(but that is quite a wild shot in the dark)

If I am correct (or close) you should update the query to:
| rex field=source "Policy\\+(?<policy>.*)\\" | rex field=source "Email\\+(?<email>.*)\\"
Which basically says "look for a string beginning with the word "Policy" followed by a single "\" then extract all the characters before the trailing "\", and write them to a field called "policy"

If you share you source name, I can validate (or correct) my guess.

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

I'm not sure I understand your question, but this maybe as a result of how its been formatted.

Can you edit your answer and post the query using the 10101 option which will show the formatting correctly.
Are you asking what the two rex statements are trying to extract?

If my comment helps, please give it a thumbs up!
0 Karma

chandra61446
New Member

Are you asking what the two rex statements are trying to extract? Yes exactly.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...