Splunk Enterprise Security

How do I use regex to select a string between two colons?

kylemain
New Member

I have a field (myfield) whose values are as follows:

"0051: IP: Source IP Address Spoofed (Impossible Packet)"   52
"0053: IP: Source IP Address Spoofed (IANA Reserved)"   8
"0091: Loki: Default Client Communications (Big Endian)"    34
"0092: Loki: Default Client Communications (Little Endian)" 67
"0290: Invalid TCP Traffic: Possible Recon Scan (SYN FIN)"  6
"0292: Invalid TCP Traffic: Possible Recon Scan (No Flags Set)"

I would like to select the text between the colons (i.e. IP, Loki, etc) and create a new field from that text. My search is:

my search | rex field=myfield "(?<=:).*?(?=:)"

This returns the following error:

Error in 'rex' command: The regex '(?<=:).*?(?=:)' does not extract anything. It should specify at least one named group. Format: (?...).

This works in my regex testing. Any help would be appreciated.

0 Karma
1 Solution

worshamn
Contributor

One of my favorite regexes (and I see Splunk use this in their config sometimes which is where I learned it) is a character class that is not the value of the ending capture like so:

| rex field=myfield ":\s+(?<newfield>[^:]+):"

View solution in original post

kylemain
New Member

thanks everyone. new to regex 🙂

0 Karma

Vijeta
Influencer

Please accept the answer that helped you .

0 Karma

worshamn
Contributor

One of my favorite regexes (and I see Splunk use this in their config sometimes which is where I learned it) is a character class that is not the value of the ending capture like so:

| rex field=myfield ":\s+(?<newfield>[^:]+):"

Vijeta
Influencer

Try this, you should get the desired value in text field

| rex field=myfield ":\s+(?<text>\S+):"
0 Karma

ddrillic
Ultra Champion

Just add the named group, like (?<=:)(?<x>.*?)(?=:).

In your context, something like - | rex field=_raw (?<=:)(?<myfield>.*?)(?=:) -

alt text

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...