How to parse specific value from a field value?

[wicke_s]

Disclaimer : I'm new to Regex and using the Rex function

I have a field "Message" that has the following string format:

"EWT_Print=282, CIQ=1, Did not meet the threshold, 009s5td"

All the Message field values are going to have the same format "EWT_Print=[some number], CIQ=[some number], some text"

I am trying to extract the value of the EWT_Print, in this example 282 and display it in a table, however, I always get an empty table when I try this:

<my base search> | rex field=Message "EWT_Print=(?<EWT>[0-9]+)*"

What am I doing wrong?

[VatsalJagani]

@wicke_s - Try this regex. (make sure field Message is not containing "(quote) in value.)

^EWT_Print=(?<EWT_Printer>\d+),

[pranay_adla]

  <base search> | rex field=Message "EWT_Print\=(?P<EWT>\d+)\,"

[vnravikumar]

Hi

Try this,

| makeresults 
| eval Message = "EWT_Print=282, CIQ=1, Did not meet the threshold, 009s5td" 
| rex field=Message "EWT_Print\=(?P<EWT>[\d]+)"

[jnudell_2 · Accepted solution]

Try:

... [ your search ] ... 

| rex "EWT_Print=(?<EWT>[^,]+),"

If that works, then try:

... [ your search ] ... 

| rex field=Message "EWT_Print=(?<EWT>[^,]+),"

[wicke_s]

This did the trick, The ',' is what I was missing.....

<search> | rex "EWT_Print=(?<EWT>[0-9]+)," 

is the query that worked for me. Thanks a lot

[jkat54]

Are you searching in verbose mode? Because verbose mode auto extracts key value pairs like these you have.

If not in verbose mode you can use the '| extract' command to achieve the same result.

[wicke_s]

Thanks for your reply! I am searching in verbose mode and I also tried the search with the "extract" keyword. Still returns empty table

[jkat54]

What's your full search?

[wicke_s]

index=<index> sourcetype=<sourcetype> Message="EWT_Print*" | rex field=Extended_Field.Message "EWT_Print=(?<EWT>[0-9]+)"| table EWT

[jkat54]

Try renaming the field first
...
| rename Extended_Field.Message as message
| rex field=message
...

[richgalloway]

Your regex looks good, although the * is not needed. It works in regex101.com. Have you tried without the *?

[wicke_s]

Yes, I got the regex from regex101.com 🙂

I tried without the * and it still doesn't work. I tried without the table and I could see I have at least 133 events matching the search, however the rex still doesn't work.

Thanks for taking the time to look into this!