Splunk Dev

Extracting up to a particular string in rex

harshparikhxlrd
Path Finder

Here's what I have.

alt text

Basically, I'm trying to just get rid of the AddiontalInfo1 and AdditionalInfo2.

Here's the rex command I"m using: | rex field=Message "Message=\"(?.*)"

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Your regex tells Splunk to grab everything in the Message field. All you need to do is tell it to stop when it gets to "AdditionalInfo".

Try | rex field=Message "Message=\"(?<field>.*) Additional".

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\"" 
| eval Message=mvindex(split(Message,"\""),0)

No, REGEX. ( ^∀^)

0 Karma

jgbricker
Contributor

If you know you will consistently see the pattern
"Message: message is here which can include punctuation and random quotes AdditionalInfo1" then my approach would be to match on and extract what you know will always precede (Message: whitespace) and then what will be after what you want (AdditionalInfo1) to terminate the regex. Then simply extract everything between. You may need to just leave the field=Message off the rex command because that field's bounds may not be accurate.

I like regex101.com for testing the regex matching

Default for rex is to go against field=_raw so you don't need to specify field=Message

I would specify it only if I knew that what i wanted to extract was always inside that field with no exceptions. The specificity of the rex field is mainly for performance as it limits scope. Your example event is pretty small so probably not a big deal to do _raw.

Between the <> you can all the newly extracted field whatever
Ignore the \'s between <>, this was how I got it to display the field name in answers
You might be able to drop the escaping of : and =

|rex "Message:\s(?<\msg_detail>(.*))AdditionalInfo1="

0 Karma

TISKAR
Builder

Hi:

CAN YOU TRY THIS PLEASE:

| makeresults
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\""
| rex field=Message "Message: (?<Message>.*?)\" AdditionalInfo"
0 Karma

jpolvino
Builder

This may work for you:

| makeresults
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\""
| rex field=Message "Message: (?<subMessage>.*?)\" Additional"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your regex tells Splunk to grab everything in the Message field. All you need to do is tell it to stop when it gets to "AdditionalInfo".

Try | rex field=Message "Message=\"(?<field>.*) Additional".

---
If this reply helps you, Karma would be appreciated.
0 Karma

harshparikhxlrd
Path Finder

This was my issue. I also found that my other issue I had was a result of using the . operator.

| rex field=Message "Message=\"(?<msg>[\s\S]*)\" AdditionalInfo1"

The dot operator doesn't consider spaces, which was causing an issue in my data. Thank you though.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...