Splunk Search

Fetch exact value using REX command

sgulhane5
Explorer

Hi,

Can someone please help me here: To fetch

value = private and operation= OVERRIDE using rex command?

I tried to fetch using below command: 

|rex max_match=0 field=_raw "IP BLOCK TYPE\",value=\"(?<IP_Block_Type>.*?)\s*(\w*+)\]"| eval IP_Block_Type= substr(IP_Block_Type, 1, len(IP_Block_Type)-1)

 

|rex max_match=0 field=_raw "IP BLOCK TYPE\",operation=\"(?<IP_Block_Type>.*?)\s*(\w*+)\]"| eval IP_Block_Type= substr(IP_Block_Type, 1, len(IP_Block_Type)-1)

 

[name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"]

 

Labels (1)
Tags (1)

sgulhane5
Explorer

@gcusello the log message is looks like  [name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"]. I just wanted to fetch operation="OVERRIDE" through the regex.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sgulhane5,

if you want to extract the value "OVERRIDE" and put it in the field "operation", my regex is correct, if instead you want all the string "operation=OVERRIDE", it's different.

Please confirm that you have the message:

[name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"]

and that you want to extract the value "Private" and put it into the field "value" and the value "OVERRIDE" and put it into the field "operation".

Only one additional question: message is a field of your full row log?

If it's the full row log, my regex is correct, if instead message is a field, you have to modify my rex command:

| rex field=message "value\=\"(?<value>[^\"]*)\",operation\=\"(?<operation>[^\"]*)"

Ciao.

Giuseppe

sgulhane5
Explorer

not working 

0 Karma

somesoni2
Revered Legend

What issues are you facing using @gcusello 's answer? 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sgulhane5,

if the logs you have is something like what you shared

[name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"]

you don't need a dedicated regex extraction because Splunk automatically recognizes pairs field=value.

Anyway, you can extract "Private" and "OVERRIDE" using this regex

| rex "value\=\"(?<value>[^\"]*)\",operation\=\"(?<operation>[^\"]*)"

that you can test at https://regex101.com/r/Y2VMtX/1

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...