Splunk Search

How to develop a regular expression to use with a field extraction?

hegeman1982
Engager

I am trying to come up with a regular expression to use with the field extractor that would return the value of a string between two strings. The basic formatting is the following:

[nls-string-val raw="Temperature (1) - Rack 4 Back Door Top">Temperature (1) - Rack 4 Back Door Top[/nls-string-val]

I would want the field extractor regex to return the following: Temperature (1) - Rack 4 Back Door Top">Temperature (1) - Rack 4 Back Door Top

*the '[' symbols above are actually '<' symbols but this forum would not let me post links. *
I was trying to use lookbehind and lookahead but was not having any success.

Any tips for how to accomplish this? The REGEX I have tried is "[nls-string-val raw="(.*)<\/nls-string-val>) and it doesn't work"

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@hegeman1982 - Just so you know, there is special markup language on this site so certain symbols will transform your post, such as the < symbols. If you wish to show the < (i.e. you are displaying sample code or regular expressions), simply click on the Code Sample icon to the right of the Blockquote icon in the formatting toolbar.

somesoni2
Revered Legend

Give this a try (test it in a search using inline rex command before putting in props.conf)

your base search | rex "nls-string-value raw=\"(?<FieldName>[^\<]+)\<\/nls-string-val" 
0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...