Security

I have a search query i like to understand what how regex field extraction is done for source in below query

chandra61446
New Member

I have a search query i like to understand what how regex field extraction is done for source in below query

Index= * "Error - [ServerError] ValidateMailDatabase: Database is not FT-indexed" | rex field=source "Policy\\\\+(?.*)\\\\" | rex field=source "Email\\\\+(?.*)\\\\"
Tags (2)
0 Karma

nickhills
Ultra Champion

Ok, So i would "think" that the intent of the regex is to look at the source of the data, and extract from that either a policy or email value (possibly both) however, the syntax for an inline rex expression is wrong!

I am assuming that the source of these logs is something like:
e:\logs\policy\MyPolicy\somelog.log
or
e:\logs\Email\your.name@email\somelog.log

(but that is quite a wild shot in the dark)

If I am correct (or close) you should update the query to:
| rex field=source "Policy\\+(?<policy>.*)\\" | rex field=source "Email\\+(?<email>.*)\\"
Which basically says "look for a string beginning with the word "Policy" followed by a single "\" then extract all the characters before the trailing "\", and write them to a field called "policy"

If you share you source name, I can validate (or correct) my guess.

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

I'm not sure I understand your question, but this maybe as a result of how its been formatted.

Can you edit your answer and post the query using the 10101 option which will show the formatting correctly.
Are you asking what the two rex statements are trying to extract?

If my comment helps, please give it a thumbs up!
0 Karma

chandra61446
New Member

Are you asking what the two rex statements are trying to extract? Yes exactly.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.