Extracting up to a particular string in rex

[harshparikhxlrd]

Here's what I have.

Basically, I'm trying to just get rid of the AddiontalInfo1 and AdditionalInfo2.

Here's the rex command I"m using: | rex field=Message "Message=\"(?.*)"

[to4kawa]

| makeresults 
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\"" 
| eval Message=mvindex(split(Message,"\""),0)

No, REGEX. ( ＾∀＾)

[jgbricker]

If you know you will consistently see the pattern
"Message: message is here which can include punctuation and random quotes AdditionalInfo1" then my approach would be to match on and extract what you know will always precede (Message: whitespace) and then what will be after what you want (AdditionalInfo1) to terminate the regex. Then simply extract everything between. You may need to just leave the field=Message off the rex command because that field's bounds may not be accurate.

I like regex101.com for testing the regex matching

Default for rex is to go against field=_raw so you don't need to specify field=Message

I would specify it only if I knew that what i wanted to extract was always inside that field with no exceptions. The specificity of the rex field is mainly for performance as it limits scope. Your example event is pretty small so probably not a big deal to do _raw.

Between the <> you can all the newly extracted field whatever
Ignore the \'s between <>, this was how I got it to display the field name in answers
You might be able to drop the escaping of : and =

|rex "Message:\s(?<\msg_detail>(.*))AdditionalInfo1="

[TISKAR]

Hi:

CAN YOU TRY THIS PLEASE:

| makeresults
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\""
| rex field=Message "Message: (?<Message>.*?)\" AdditionalInfo"

[jpolvino]

This may work for you:

| makeresults
| eval Message="Automation: OS, Message: OS-001, AppName: The Outlook btnNext control not created.\" AdditionalInfo1=\"NA\" AdditionalInfo2=\"NA\""
| rex field=Message "Message: (?<subMessage>.*?)\" Additional"

[richgalloway · Accepted solution]

Your regex tells Splunk to grab everything in the Message field. All you need to do is tell it to stop when it gets to "AdditionalInfo".

Try | rex field=Message "Message=\"(?<field>.*) Additional".

[harshparikhxlrd]

This was my issue. I also found that my other issue I had was a result of using the . operator.

| rex field=Message "Message=\"(?<msg>[\s\S]*)\" AdditionalInfo1"

The dot operator doesn't consider spaces, which was causing an issue in my data. Thank you though.