Splunk Search

Help with Rex Field Extraction

scout29
Path Finder

I am trying to write a rex command that extracts the field "registrar" from the below four event examples. The below values in bold are what i am looking for to be the value for "registrar".  I am using the following regex to extract the field and values, but i seem to be capturing the \r\n after the bold values as well.  How can i modify my regex to capture just the company name in bold leading up to \r\n Registrar IANA

Current regex being used:   Registrar:\s(?<registrar>.*?) Registrar IANA

 

Expiry Date: 2026-12-09T15:18:58Z\r\n Registrar: ABC Holdings, Inc.\r\n Registrar IANA ID: 972

Expiry Date: 2026-12-09T15:18:58Z\r\n Registrar: Gamer.com, LLC\r\n Registrar IANA ID: 837

Expiry Date: 2026-12-09T15:18:59Z\r\n Registrar: NoCo MFR Ltd.\r\n Registrar IANA ID: 756

Expiry Date: 2026-12-09T15:18:59Z\r\n Registrar: Onetrust Group, INC\r\n Registrar IANA ID: 478

Labels (5)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @scout29 ,

please try this:

| rex "Registrar:\s+(?<Registrar>[^\\]*)"

that you can test at https://regex101.com/r/7PdpcJ/1

If it doesn't run on Splunk use three backslashes in the square parenthesis (sometimes Splunk is strange in regex extractions!).

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @scout29 ,

please try this:

| rex "Registrar:\s+(?<Registrar>[^\\]*)"

that you can test at https://regex101.com/r/7PdpcJ/1

If it doesn't run on Splunk use three backslashes in the square parenthesis (sometimes Splunk is strange in regex extractions!).

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @scout29 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Add in the \r\n to the regex, i.e.

| rex "Registrar:\s(?<registrar>.*?)\\\r\\\n Registrar IANA"

Note 3 slashes

I assume those \r\n are literal characters rather than CR/LF?

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...