How can I match a bearer token after bearer is found in a log?

[mgpspr]

Hello,

I'm trying to match a bearer token. How can I match the token after Bearer that is found in a log? Bearer eddc46d4-cc9a-4697-885a-c342ce650a77

[jplumsdaine22]

It's hard to be sure without seeing your data, but you could try try the following rex command

... | rex field=_raw "Bearer\s(?<bearer_token>[^\s]+) "| table bearer_token

Modify the regex as required based on your data. https://regex101.com/ is a good place to test regex strings.

See http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Rex

[jplumsdaine22]

Are you trying to search for a specific token or extract the value of bearer ?

[mgpspr]

Extract the value of the tokens after the word Bearer