I have raw data like:
Error=REQUEST ERROR | request is not valid.|","time":"1707622073040"
and I want to extract "REQUEST ERROR | request is not valid." to a new field, so I try to use rex to match until |" with below query but it still only returns "REQUEST ERROR"
|rex field=_raw "Error\=(?<ErrDesc>[^|\"]+)"
I just figured it out with guidance from https://stackoverflow.com/questions/7124778/how-can-i-match-anything-up-until-this-sequence-of-chara...
correct rex will be
|rex field=_raw "Error\=(?<ErrDesc>.+?(?=\|\"))"
thanks for help!
Hi @adamsobczykhsbc,
please try this:
| rex "Error\=(?<ErrDesc>[^\|]+\|[^\|]+)"
that you can test at https://regex101.com/r/mIlDeU/1
Ciao.
Giuseppe
Hi @gcusello , it works for that specific case, however my extracted field ErrDesc will not always have pipe "|" inside, basically I want to match anything until |" , no matter if pipe is in the field or not
I just figured it out with guidance from https://stackoverflow.com/questions/7124778/how-can-i-match-anything-up-until-this-sequence-of-chara...
correct rex will be
|rex field=_raw "Error\=(?<ErrDesc>.+?(?=\|\"))"
thanks for help!
Hi @adamsobczykhsbc ,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉