Splunk Search

How to use rex on a QR String to cut out a part that I want

phamxuantung
Communicator

I have a QR String that when put in our custom QR divider can took it apart nicely. But I can't use the field extraction for this. How do I use custom rex. Example:

- My QR String:00020101021253037045405100005802VN38620010A0000007270132000697110001180003131000000032040208QRIBFTTA624101121000000032040821 ORD_6328416304A3AC

- The string I want to take out is 00069711000118000313100000003204 and 000697 (The first 6 characters) as field1 and field2.

Fortunately the 4 characters before and 4 characters behind don't chance.

Labels (2)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

This should work.

| makeresults 
| eval str="00020101021253037045405100005802VN38620010A0000007270132000697110001180003131000000032040208QRIBFTTA624101121000000032040821 ORD_6328416304A3AC" 
| rex field=str "^\w+0132(?<field1>\S+)0208" 
| eval field2=substr(field1,0,6) | table field*

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @phamxuantung 

Without boundaries pre-defined set of chars ahead or delimiter or pattern its tough to extract. For rex the user has to give an indication from where to start extracting and where to end boundaries.. 

0 Karma

phamxuantung
Communicator

hi @venkatasri 

The 4 characters before the string start always be 0132 and the 4 characters after the string end always be 0208. Will this be more feasible?

0 Karma

venkatasri
SplunkTrust
SplunkTrust

This should work.

| makeresults 
| eval str="00020101021253037045405100005802VN38620010A0000007270132000697110001180003131000000032040208QRIBFTTA624101121000000032040821 ORD_6328416304A3AC" 
| rex field=str "^\w+0132(?<field1>\S+)0208" 
| eval field2=substr(field1,0,6) | table field*
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...