Splunk Search

How to extract a field using rex that contains backslash and double quotation marks?

retro-bloke
Explorer

in the raw event there is a line that goes Brand\="xyz"

 

What's the rex command I can use to extract this in my search?

 

If possible, I'd like to remove the \ and "" from the extraction itself.

Labels (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @retro-bloke ... May i know if you are looking for a rex search query 

or..

you want to update the props.conf file for the purpose of field extraction, please confirm, thanks.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

retro-bloke
Explorer

Hi @inventsekar, I am looking for a rex search query

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @retro-bloke 

Please check this: (you may need to modify little bit, depending on your logs.. if this does not work, pls give us some sample events)

 

| makeresults | eval temp="the test event is Brand\=\"xyz\"" 
|rex field=temp "(?P<brand>\w+)\"" 
|table temp brand

 

rex-brand.png

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

retro-bloke
Explorer

I found that this also works

 

rex "Brand\\\=\"(?<brand>.*?)\""

 

the triple quotation marks escape the \, the \" surrounding the () handles the quotation marks in the event itself.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...