Splunk Search
Highlighted

How do you extract fields that end with a question?

Explorer

I wanted to extract a field to capture the data before the question mark as below.

api_call "Get \search\ip\6789\?=number\90"

where api_call is an already extracted field.

I wrote it as a rex field = api_call "/"(?[^/?])" ---- result required is Get \search\ip\6789\
but it doesn't seem to work.

0 Karma
Highlighted

Re: How do you extract fields that end with a question?

Ultra Champion

When you want to escape special characters like quotes and questionmarks, you need to do that using a \ not a /. Anyway no need to escape that questionmark in that location in the regex. You also need to add a + to make it match multple non-? characters.

Try this: rex field = api_call "\"(?<field1>[^?]+)"

https://regex101.com/r/zaolbY/1

Highlighted

Re: How do you extract fields that end with a question?

Communicator

Hi @Deepz2612

I have tried this regex for extracting the field messsage. (it worked with regex101.com)
\"(?<message>\w+\s\S+)\?`

wit rex it should look like this:
rex field=api_call "\"(?<message>\w+\s\S+)\?"

0 Karma
Highlighted

Re: How do you extract fields that end with a question?

Ultra Champion

Using \S+ is not very efficient (as it includes the ? and will require backtracking to get the actual match). And in this case there is no need for it. (in this tiny example, it causes 32 steps to complete according to regex101, compared to 9 for my solution).

Highlighted

Re: How do you extract fields that end with a question?

Champion

Hi @Deepz2612

Please try

| makeresults 
| eval api_call= "Get \search\ip\6789\?=number\90" 
| rex field=api_call "(?P<result>.*)\?="
0 Karma
Highlighted

Re: How do you extract fields that end with a question?

Ultra Champion

Using .* should be avoided where possible (as it triggers excessive matching and backtracking) and in this case there is no need for it. (in this tiny example, it causes 30 steps to complete according to regex101, compared to 9 for my solution).

0 Karma
Highlighted

Re: How do you extract fields that end with a question?

Motivator

This works:

| makeresults
| eval foo= "Get \search\ip\6789\?=number\90"
| rex field=foo "(?<api_call>[^\?]+)\?"
| table api_call foo

api_call                foo
Get \search\ip\6789\    Get \search\ip\6789\?=number\90
0 Karma