REGEX - Splunk Community

Splunk Enterprise Security

I want to get the result of 'AccessControlRuleName' in a separate field set using REGEX.

Sample log:

"AccessControlRuleName: PCIWAN_Access_In_#4-no-lookup,"

What would be the Regex query or detail to create a new field set for the above? Need some help on this.

Assuming the value is always delimited by a comma, try this

| rex "AccessControlRuleName:\s+(?<AccessControlRuleName>[^,]+)"

Hi ...Thanks for the quick response for my regex query.

Get Updates on the Splunk Community!

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl. To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...