Fetch exact value using REX command

[sgulhane5]

Hi,

Can someone please help me here: To fetch

value = private and operation= OVERRIDE using rex command?

I tried to fetch using below command: 

|rex max_match=0 field=_raw "IP BLOCK TYPE\",value=\"(?<IP_Block_Type>.*?)\s*(\w*+)\]"| eval IP_Block_Type= substr(IP_Block_Type, 1, len(IP_Block_Type)-1)

|rex max_match=0 field=_raw "IP BLOCK TYPE\",operation=\"(?<IP_Block_Type>.*?)\s*(\w*+)\]"| eval IP_Block_Type= substr(IP_Block_Type, 1, len(IP_Block_Type)-1)

[name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"]

[sgulhane5]

@gcusello the log message is looks like  [name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"]. I just wanted to fetch operation="OVERRIDE" through the regex.

[gcusello]

Hi @sgulhane5,

if you want to extract the value "OVERRIDE" and put it in the field "operation", my regex is correct, if instead you want all the string "operation=OVERRIDE", it's different.

Please confirm that you have the message:

[name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"]

and that you want to extract the value "Private" and put it into the field "value" and the value "OVERRIDE" and put it into the field "operation".

Only one additional question: message is a field of your full row log?

If it's the full row log, my regex is correct, if instead message is a field, you have to modify my rex command:

| rex field=message "value\=\"(?<value>[^\"]*)\",operation\=\"(?<operation>[^\"]*)"

Ciao.

Giuseppe

[sgulhane5]

not working 

[somesoni2]

What issues are you facing using @gcusello 's answer? 

[gcusello]

Hi @sgulhane5,

if the logs you have is something like what you shared

[name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"]

you don't need a dedicated regex extraction because Splunk automatically recognizes pairs field=value.

Anyway, you can extract "Private" and "OVERRIDE" using this regex

| rex "value\=\"(?<value>[^\"]*)\",operation\=\"(?<operation>[^\"]*)"

that you can test at https://regex101.com/r/Y2VMtX/1

Ciao.

Giuseppe