Splunk Search

How do you extract fields that end with a question?

Deepz2612
Explorer

I wanted to extract a field to capture the data before the question mark as below.

api_call "Get \search\ip\6789\?=number\90"

where api_call is an already extracted field.

I wrote it as a rex field = api_call "/"(?[^/?])" ---- result required is Get \search\ip\6789\
but it doesn't seem to work.

0 Karma

wrangler2x
Motivator

This works:

| makeresults
| eval foo= "Get \search\ip\6789\?=number\90"
| rex field=foo "(?<api_call>[^\?]+)\?"
| table api_call foo

api_call                foo
Get \search\ip\6789\    Get \search\ip\6789\?=number\90
0 Karma

vnravikumar
Champion

Hi @Deepz2612

Please try

| makeresults 
| eval api_call= "Get \search\ip\6789\?=number\90" 
| rex field=api_call "(?P<result>.*)\?="
0 Karma

FrankVl
Ultra Champion

Using .* should be avoided where possible (as it triggers excessive matching and backtracking) and in this case there is no need for it. (in this tiny example, it causes 30 steps to complete according to regex101, compared to 9 for my solution).

0 Karma

markusspitzli
Communicator

Hi @Deepz2612

I have tried this regex for extracting the field messsage. (it worked with regex101.com)
\"(?<message>\w+\s\S+)\?`

wit rex it should look like this:
rex field=api_call "\"(?<message>\w+\s\S+)\?"

0 Karma

FrankVl
Ultra Champion

Using \S+ is not very efficient (as it includes the ? and will require backtracking to get the actual match). And in this case there is no need for it. (in this tiny example, it causes 32 steps to complete according to regex101, compared to 9 for my solution).

FrankVl
Ultra Champion

When you want to escape special characters like quotes and questionmarks, you need to do that using a \ not a /. Anyway no need to escape that questionmark in that location in the regex. You also need to add a + to make it match multple non-? characters.

Try this: rex field = api_call "\"(?<field1>[^?]+)"

https://regex101.com/r/zaolbY/1

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...