Splunk Search

How to write the regex to extract a field for offset columns?

jlim2003
New Member

Hello,

I am trying to extract a field that is offset by one column:

Event 1: [DT_2.0_REAL][0x80c00002]
Event 2: [0x80c00002]
Event 3: [HONDA_REAL][0x80c00002]
Event 4: [0x80c00002]

As you can see, the [0x80c00002] is offset by one column here, so the automatic field extraction fails.

How can I adjust the regex to account for this offset? Thanks!

0 Karma

woodcock
Esteemed Legend

If you are always going for the last one, like this:

... | rex "\[(?<lastBracketedField>[^\]]+)\]$"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Do you need the enclosing brackets? This regex will extract the field without them.

(?P<field>0x[^\]]+)
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...