Can someone please give me an explanation as to what the below rex command is doing?

[auzark]

Can someone please give me an explanation as to what the below rex command is doing.

I do not understand the w+ s+ d+ etc........

| rex field=_raw "(?ms)^\\w+\\s+\\d+\\s+\\d+:\\d+:\\d+\\s+\\w+\\s+\\w+\\s+\\w+:\\s+\\w+:\\s+\\w+\\s+\\w+:\\s+\\w+\\s+\\w+\\s+\\w+:\\s+\\d+\\s+\\w+\\s+\\w+:\\s+\\d+\\-\\d+\\-\\d+\\s+\\d+:\\d+:\\d+\\s+\\w+:\\s+

(?P<Time>[^ ]+)\\s+

(?P<Trn_Total>\\d+)\\s+

(?P<Trn_Interval>\\d+)\\s+

(?P<TPS>[^ ]+)\\s+

(?P<SW_Inbound>[^ ]+)\\s+

(?P<SW_Outbound>[^ ]+)\\s+

(?P<SW_Total>[^ ]+)\\s+

(?P<SW_Ext_Pmc>[^ ]+)\\s+

(?P<SW_Int_Pmc>\\d+\\.\\d+)" offset_field=_extracted_fields_bounds

[gcusello · Accepted solution]

Hi @auzark,

the best approach is to read the links that @bowesmana shared.

In few words, the objects in regexes are a way to represent the strings to read, in other words, if you have to read 

2022-12-08 21:25:03 10.10.10.10 user goofy successfully accessed host srvwin001 from 10.10.20.241

and you have to extract a part of the string (e.g. "goofy") you have to identi

2022-12-08 21:25:03 10.10.10.10 user goofy successfully accessed host srvwin001 from 10.10.20.241

fy the part of the string using the objects, from the beginning e.g.

^\d+-\d+-\d+\s+\d+:\d+:\d+\s+\d+\.\d+\.\d+\.\d+\s+user\s+(?<user>\w+)

or from a fixed point

user\s+(?<user>\w+)

the group inside quotes "?<field_name>\w+" is the field to extract, all that is outside quotes is useful to identify the field to extract.

you can find the meaning of each objects in regex101.com.

Ciao.

Giuseppe

[bowesmana]

Good starting point for understanding regex is

https://regex101.com/

and

https://www.regular-expressions.info/

You can see documentation on the shorthand character classes, such as \d, \w and \s here

https://www.regular-expressions.info/shorthand.html

Brackets are using for capturing groups - e.g. (?P<Time>[^ ]+)

https://www.regular-expressions.info/brackets.html

captures the expression matched by all characters up to the subsequent space into the field called Time