Splunk Search

How do you extract fields that end with a question?

Deepz2612
Explorer

I wanted to extract a field to capture the data before the question mark as below.

api_call "Get \search\ip\6789\?=number\90"

where api_call is an already extracted field.

I wrote it as a rex field = api_call "/"(?[^/?])" ---- result required is Get \search\ip\6789\
but it doesn't seem to work.

0 Karma

wrangler2x
Motivator

This works:

| makeresults
| eval foo= "Get \search\ip\6789\?=number\90"
| rex field=foo "(?<api_call>[^\?]+)\?"
| table api_call foo

api_call                foo
Get \search\ip\6789\    Get \search\ip\6789\?=number\90
0 Karma

vnravikumar
Champion

Hi @Deepz2612

Please try

| makeresults 
| eval api_call= "Get \search\ip\6789\?=number\90" 
| rex field=api_call "(?P<result>.*)\?="
0 Karma

FrankVl
Ultra Champion

Using .* should be avoided where possible (as it triggers excessive matching and backtracking) and in this case there is no need for it. (in this tiny example, it causes 30 steps to complete according to regex101, compared to 9 for my solution).

0 Karma

markusspitzli
Communicator

Hi @Deepz2612

I have tried this regex for extracting the field messsage. (it worked with regex101.com)
\"(?<message>\w+\s\S+)\?`

wit rex it should look like this:
rex field=api_call "\"(?<message>\w+\s\S+)\?"

0 Karma

FrankVl
Ultra Champion

Using \S+ is not very efficient (as it includes the ? and will require backtracking to get the actual match). And in this case there is no need for it. (in this tiny example, it causes 32 steps to complete according to regex101, compared to 9 for my solution).

FrankVl
Ultra Champion

When you want to escape special characters like quotes and questionmarks, you need to do that using a \ not a /. Anyway no need to escape that questionmark in that location in the regex. You also need to add a + to make it match multple non-? characters.

Try this: rex field = api_call "\"(?<field1>[^?]+)"

https://regex101.com/r/zaolbY/1

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...