Splunk Search

How to extract a sequence from this log with rex command

splunk2019tlmd
Engager

I have this log :

        <LST>
      <S>Watch</S>
      <S>Move</S>
      <S>Delete</S>
      <S>Flip</S>
    </LST>

And I want to extract this part with rex syntax :

  <S>Watch</S>
      <S>Move</S>
      <S>Delete</S>
      <S>Flip</S>

But I am not having success , I think is because the specials characters.

Thank you in advance

Tags (2)
0 Karma
1 Solution

to4kawa
Ultra Champion
| rex max_match=0 "(?<attr>\<\w\>\w+\<\/\w\>)"

use \ (back slash)

View solution in original post

to4kawa
Ultra Champion
| rex max_match=0 "(?<attr>\<\w\>\w+\<\/\w\>)"

use \ (back slash)

splunk2019tlmd
Engager

It works but the outputs is one line, in case I want the sequence (Move Delete Flip) ) in one line, I guess I have to replicate the example. Thank you

0 Karma

to4kawa
Ultra Champion
 ....
| eval sequence=mvjoin(attr," ")

try this

0 Karma
Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...