Help with Rex Field Extraction

[scout29]

I am trying to write a rex command that extracts the field "registrar" from the below four event examples. The below values in bold are what i am looking for to be the value for "registrar".  I am using the following regex to extract the field and values, but i seem to be capturing the \r\n after the bold values as well.  How can i modify my regex to capture just the company name in bold leading up to \r\n Registrar IANA

Current regex being used:   Registrar:\s(?<registrar>.*?) Registrar IANA

Expiry Date: 2026-12-09T15:18:58Z\r\n Registrar: ABC Holdings, Inc.\r\n Registrar IANA ID: 972

Expiry Date: 2026-12-09T15:18:58Z\r\n Registrar: Gamer.com, LLC\r\n Registrar IANA ID: 837

Expiry Date: 2026-12-09T15:18:59Z\r\n Registrar: NoCo MFR Ltd.\r\n Registrar IANA ID: 756

Expiry Date: 2026-12-09T15:18:59Z\r\n Registrar: Onetrust Group, INC\r\n Registrar IANA ID: 478

[gcusello · Accepted solution]

Hi @scout29 ,

please try this:

| rex "Registrar:\s+(?<Registrar>[^\\]*)"

that you can test at https://regex101.com/r/7PdpcJ/1

If it doesn't run on Splunk use three backslashes in the square parenthesis (sometimes Splunk is strange in regex extractions!).

Ciao.

Giuseppe

[gcusello]

Hi @scout29 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[bowesmana]

Add in the \r\n to the regex, i.e.

| rex "Registrar:\s(?<registrar>.*?)\\\r\\\n Registrar IANA"

Note 3 slashes

I assume those \r\n are literal characters rather than CR/LF?