How to edit my regular expression to extract a string between percentages and other characters?

[jjmel]

I have to get "THIS" out of O_name%253DTHIS%2526, for my_field.

I'm a regex newb.

i tried the following but it is not working:

|rex field=_raw "O_name%253D(?P<my_field>[^\s]+)%2526"

[govindsinghrawa · Accepted solution]

Your answer should work but alternatively you can try as below:

O_name%\d{3}[A-Za-z](?P< my_field >[^\%]+)

where the string starts with O_name%
then waits for 3 digits with \d{3}
then an alphabet A to Z or small case a to z with [A-Za-z]
then the field extraction (?P< my_field >[^\%]+) to stop reading at a %
then a + to match non % as many times till you hit a %

NOTE: Added space between < and my_field and > as the formatting on the website wasn't allowing without space <.my_field>

[jjmel]

i got an error with this. mine returns a value, but it isnt the THIS value. it returns a big chunk of the event that i dont want, maybe because it looks for the very last instance of "%2526" to cut it off, when it should look for the first "%2526" right after "O_name%253D." there are other values besides O_name, like O_route, O_product that follow the same pattern. So the O_* part is kind of a delimiter that is specific to each value.

[lukejadamec]

I think you might have made a mistake.... I created some events, and tested this and it works.

|rex field=_raw "O_name%\d{3}[A-Za-z](?P< TheName>[^\%]+)" |table TheName

Don't forget to remove the space in the regex in the brackets before TheName
If it is not working for you then perhaps you should post some actual events.

[jjmel]

youre right. my apologies to govindsinghrawat. answer accepted. thanks, all!!

[lukejadamec]

Is 'THIS' always after % 3 digits and a letter, and does 'THIS' always end with a %?

[jjmel]

THIS always comes after "O_name%253D" and before "%2526," and there are other values besides O_name, like O_route, O_product that follow the same pattern. So the O_* part is kind of a delimiter that is specific to each value.

[lquinn]

Have you got an example of the full event? I can't see anything immediately wrong with this ...

[jjmel]

gave some more context below