Splunk Search

How to extract a field using rex that contains backslash and double quotation marks?

retro-bloke
Explorer

in the raw event there is a line that goes Brand\="xyz"

 

What's the rex command I can use to extract this in my search?

 

If possible, I'd like to remove the \ and "" from the extraction itself.

Labels (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @retro-bloke ... May i know if you are looking for a rex search query 

or..

you want to update the props.conf file for the purpose of field extraction, please confirm, thanks.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

retro-bloke
Explorer

Hi @inventsekar, I am looking for a rex search query

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @retro-bloke 

Please check this: (you may need to modify little bit, depending on your logs.. if this does not work, pls give us some sample events)

 

| makeresults | eval temp="the test event is Brand\=\"xyz\"" 
|rex field=temp "(?P<brand>\w+)\"" 
|table temp brand

 

rex-brand.png

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

retro-bloke
Explorer

I found that this also works

 

rex "Brand\\\=\"(?<brand>.*?)\""

 

the triple quotation marks escape the \, the \" surrounding the () handles the quotation marks in the event itself.

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...