Splunk Search

Need help with rex command

locose
Path Finder

Hello I'm trying to run a rex command to extract "is set to expire"

Relying party trust 'ButterCup Games - Test'
xxxxx: Signing certificate with thumbprint '1111111111111111111111' is set to expire on 2/13/2020 6:59:59 PM.

Tags (1)
0 Karma

vnravikumar
Champion

Hi

If you want to extract date/time, please try the following

| makeresults 
| eval temp="xxxxx: Signing certificate with thumbprint '1111111111111111111111' is set to expire on 2/13/2020 6:59:59 PM." 
| rex field=temp "set to expire on\s(?P<expireon>\d{1,2}\/\d{1,2}\/\d{4}\s\d{1,2}\:\d{1,2}\:\d{1,2}\s(AM|PM))"
0 Karma

to4kawa
SplunkTrust
SplunkTrust
|rex "(?<youWant>\d{5,})"
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!