How to generate a regular expression that extracts a field in my event data?

[jeck11]

I need to do a field extraction for everything after the ) to the end of the first line. I've tried about every regex I can think of to signify EOL but nothing seems to work so far.

Here is an event sample:
2017-02-22T18:01:04 | Creating request for https://0.0.0.0/images/logo.gif (msecure.company.com) Mobile US Site1 VIP
2017-02-22T18:01:04 | Information SSL1399 - The certificate is valid.; Data: Mobile US Site1 VIP; URL: https://0.0.0.0/images/logo.gif; Domain: msecure.company.com; Expiration: 08/10/2018 08:00:00

So for this event I would want this field to be "Mobile US Site1 VIP".

I'm sure I'm messing something up. Thanks in advanced!

[jrballesteros05 · Accepted solution]

Hi, sorry if I misunderstood.

Is that a multiline event? If so, you should use this one:

.*?\)\s+(?P<description>.*?)\n

[jeck11]

YES! That did it. Thanks!

[somesoni2]

@Jeck11, glad @jrballesteros05's answer provided a working solution to your question? Please don't forget to resolve this post by clicking "Accept".

[jrballesteros05]

This one seems to work for me:

 .*?\)\s+(?P<description>.*)

[jeck11]

Yeah. That's what I came up with when using an external site like https://www.regex101.com/. Unfortunately, when I try that in Splunk it begins at the correct spot but goes all the way to the end of the last line instead of stopping at the end of line 1.

[pkeller]

So your example is a multi-line event? .... This might work: ^.[^)]+)\s+(?P.+)\n?

[horsefez]

Is this what you are trying to do?

(?:^)(?:[^\)]+\)\s)(.+)

[jeck11]

Your regex doesn't appear to select anything when I try it.

Here is the regex that Splunk gives me when I try and do it through the wizard:

^[^\)\n]*\)\s+(?P<description>\w+\s+\w+\s+\w+\s+\w+)

This will select anything up to a special character but the final field could have a dash ("-") in it and I can't control how long it is either.

[pkeller]

This seems to work at: https://www.regex101.com/

^.[^)]+)\s+(?P.+)