Need to create rex command to extract field

[Mrig342]

Hi,

We have below type of logs:

Log1-- 2021-02-02 10:12:49.889, APP_NAME="com.abcdef.abcdefghijkl", APP_TEMP_NAME="com.abcdef.abcdefghijkl", APP_TEMP_VER="1.0.11.20210120114351539", LASTDEPLOYED="2021-01-27 13:41:12.389", ENV_NAME="ABCEnvironment_AB"

Log2-- 2021-02-02 10:12:49.889, APP_NAME="com.abcdef.st.xyz", APP_TEMP_NAME="com.abcdef.st.xyz-1", APP_TEMP_VER="1.1.4", LASTDEPLOYED="2018-11-18 05:59:44.333", ENV_NAME="ABCEnvironment_CD"

From here I want to extract the below fields with separate rex commands for each.

APP_NAME, APP_TEMP_NAM, APP_TEMP_VER, LASTDEPLOYED, ENV_NAME

But I am unable to create the rex commands as expected.

Can someone please help me in creating the rex commands..?

[Mrig342]

Thank you richgalloway for your support.

[ITWhisperer · Accepted solution]

| rex "APP_NAME=\\\"(?P<APP_NAME>[^\\\"]+)"
| rex "APP_TEMP_NAME=\\\"(?P<APP_TEMP_NAME>[^\\\"]+)"
| rex "APP_TEMP_VER=\\\"(?P<APP_TEMP_VER>[^\\\"]+)"
| rex "LASTDEPLOYED=\\\"(?P<LASTDEPLOYED>[^\\\"]+)"
| rex "ENV_NAME=\\\"(?P<ENV_NAME>[^\\\"]+)"

[Mrig342]

Hi ITWhisperer,

Thank you very much for your support. The commands are working fine.

[richgalloway]

What have you tried so far?  Have you used regex101.com to help construct regexes?

The general form of the regex is

{fieldName}=\"(?<{fieldName}[^\"]+)

where {fieldName} is a placeholder for the field you wish to extract.  When applied to the rex command it becomes, for example:

| rex "APP_NAME=\\\"(?<APP_NAME>[^\\\"]+)"

 The extra backslashes are for the multiple layers the regex passes through before it reaches Splunk's regex parser.