Splunk Search

Help writting and fixing a rex query

phamxuantung
Communicator

Hello,

I have a raw data that go like this

 

...
in[ 60: ]<3034>
in[ 62: ]<10>
in[ 62: ]<EC_CARDVER>
...

 

 

I want to extract the EC_CARDVER to a field name msg

My rex is

 

| rex field=_raw "(in)\[ 62: \]\<(?P<msg>)\>"

 

But it doesn't seem to catch on. How do I write to extract only the EC_CARDVER but not the 10 above it?

Labels (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Assuming the difference is the first character must not be numerical, try

| rex "in\[ *\d+: *]<(?<msg>\D[^>]+)"

(You don't need to specify field when using _raw.)

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

Assuming the difference is the first character must not be numerical, try

| rex "in\[ *\d+: *]<(?<msg>\D[^>]+)"

(You don't need to specify field when using _raw.)

phamxuantung
Communicator

Your query extract a different fields than what I want, because there're many rows that have 'in [ ]' before, so I tweak it a bit

| rex "in\[ *62+: *]<(?<msg>\D[^>]+)"

Then it work just the way I want it to. Thank you

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...