Splunk Search

I require rex which stops search on first match of word in string.

Explorer

I have below raw text.
\"LDCAccountNumber\":\"4346780895\",\"BudgetBilling\":\"N\",\"TaxExempt\":\"N\",{\"field\":\"BudgetBilling\",

I have created rex ( rex "LDCAccountNumber(?[^*]*)BudgetBilling") to take value between LDCAccountNumber and BudgetBilling. but BudgetBilling is repeating word in the string so getting wrong result.
Currnent output :\"4346780895\",\"BudgetBilling\":\"N\",\"TaxExempt\":\"N\",{\"field\"
required output : 4346780895

it should stop on first match word.

Thanks in advance.

0 Karma

Legend

Hi shukan,
I don't understand if backslashes in the string of your message are in your log or it's a visualization problem.
Anyway, if your log is with backslashes, try this regex

LDCAccountNumber\\\":\\\"(?<LDCAccountNumber>\d+)\\\",\\\"BudgetBilling

If otherwise, your log is without backslashes try the following regex

LDCAccountNumber\":\"(?<LDCAccountNumber>\d+)\",\"BudgetBilling

You can test it at https://regex101.com/r/RcXlxa/1
Bye.
Giuseppe

0 Karma