Splunk Search

How to use rex to extract field before two symbols

adamsobczykhsbc
Explorer

I have raw data like:

 

 

Error=REQUEST ERROR | request is not valid.|","time":"1707622073040"

 

 

and I want to extract "REQUEST ERROR | request is not valid." to a new field, so I try to use rex to match until |" with below query but it still only returns "REQUEST ERROR"

 

 

|rex field=_raw "Error\=(?<ErrDesc>[^|\"]+)" 

 

 

 

Labels (1)
0 Karma
1 Solution

adamsobczykhsbc
Explorer

I just figured it out with guidance from https://stackoverflow.com/questions/7124778/how-can-i-match-anything-up-until-this-sequence-of-chara... 

correct rex will be

|rex field=_raw "Error\=(?<ErrDesc>.+?(?=\|\"))"

thanks for help!

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @adamsobczykhsbc,

please try this:

| rex "Error\=(?<ErrDesc>[^\|]+\|[^\|]+)"

that you can test at https://regex101.com/r/mIlDeU/1

Ciao.

Giuseppe

0 Karma

adamsobczykhsbc
Explorer

Hi @gcusello , it works for that specific case, however my extracted field ErrDesc will not always have pipe "|" inside, basically I want to match anything until |" , no matter if pipe is in the field or not

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @adamsobczykhsbc,

could you share some sample of your logs (both cases)?.

Ciao.

Giuseppe

0 Karma

adamsobczykhsbc
Explorer

I just figured it out with guidance from https://stackoverflow.com/questions/7124778/how-can-i-match-anything-up-until-this-sequence-of-chara... 

correct rex will be

|rex field=_raw "Error\=(?<ErrDesc>.+?(?=\|\"))"

thanks for help!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @adamsobczykhsbc ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...