Splunk Search

How to develop a regular expression to use with a field extraction?

hegeman1982
Engager

I am trying to come up with a regular expression to use with the field extractor that would return the value of a string between two strings. The basic formatting is the following:

[nls-string-val raw="Temperature (1) - Rack 4 Back Door Top">Temperature (1) - Rack 4 Back Door Top[/nls-string-val]

I would want the field extractor regex to return the following: Temperature (1) - Rack 4 Back Door Top">Temperature (1) - Rack 4 Back Door Top

*the '[' symbols above are actually '<' symbols but this forum would not let me post links. *
I was trying to use lookbehind and lookahead but was not having any success.

Any tips for how to accomplish this? The REGEX I have tried is "[nls-string-val raw="(.*)<\/nls-string-val>) and it doesn't work"

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@hegeman1982 - Just so you know, there is special markup language on this site so certain symbols will transform your post, such as the < symbols. If you wish to show the < (i.e. you are displaying sample code or regular expressions), simply click on the Code Sample icon to the right of the Blockquote icon in the formatting toolbar.

somesoni2
Revered Legend

Give this a try (test it in a search using inline rex command before putting in props.conf)

your base search | rex "nls-string-value raw=\"(?<FieldName>[^\<]+)\<\/nls-string-val" 
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...