Splunk Enterprise Security

How do I use regex to select a string between two colons?

kylemain
New Member

I have a field (myfield) whose values are as follows:

"0051: IP: Source IP Address Spoofed (Impossible Packet)"   52
"0053: IP: Source IP Address Spoofed (IANA Reserved)"   8
"0091: Loki: Default Client Communications (Big Endian)"    34
"0092: Loki: Default Client Communications (Little Endian)" 67
"0290: Invalid TCP Traffic: Possible Recon Scan (SYN FIN)"  6
"0292: Invalid TCP Traffic: Possible Recon Scan (No Flags Set)"

I would like to select the text between the colons (i.e. IP, Loki, etc) and create a new field from that text. My search is:

my search | rex field=myfield "(?<=:).*?(?=:)"

This returns the following error:

Error in 'rex' command: The regex '(?<=:).*?(?=:)' does not extract anything. It should specify at least one named group. Format: (?...).

This works in my regex testing. Any help would be appreciated.

0 Karma
1 Solution

worshamn
Contributor

One of my favorite regexes (and I see Splunk use this in their config sometimes which is where I learned it) is a character class that is not the value of the ending capture like so:

| rex field=myfield ":\s+(?<newfield>[^:]+):"

View solution in original post

kylemain
New Member

thanks everyone. new to regex 🙂

0 Karma

Vijeta
Influencer

Please accept the answer that helped you .

0 Karma

worshamn
Contributor

One of my favorite regexes (and I see Splunk use this in their config sometimes which is where I learned it) is a character class that is not the value of the ending capture like so:

| rex field=myfield ":\s+(?<newfield>[^:]+):"

View solution in original post

Vijeta
Influencer

Try this, you should get the desired value in text field

| rex field=myfield ":\s+(?<text>\S+):"
0 Karma

ddrillic
Ultra Champion

Just add the named group, like (?<=:)(?<x>.*?)(?=:).

In your context, something like - | rex field=_raw (?<=:)(?<myfield>.*?)(?=:) -

alt text

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!