Splunk Search

RegEx _raw extraction help

kdb8916
Explorer

I am trying to extract info from the _raw result of my Splunk query. Currently my _raw result is:
_raw="2014-02-13 13:02:10,3,VIDEO_STREAMING,CAMERA_6,\"Video has stopped or is intermittent for camera 6='Tool Corral Rear Aisle' on encoder 192.168.2.101.\"

I would like to extract the Camera Name, which in this case is 'Tool Corral Rear Aisle', from the above _raw string.

Can anyone help?

Thanks so much!

Tags (2)
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

Try this:

(?<cam_name>[^=]+)(?=\son\sencoder)

usage:

your base search | rex "(?<cam_name>[^=]+)(?=\son\sencoder)"

View solution in original post

sbrant_splunk
Splunk Employee
Splunk Employee

Try this:

(?<cam_name>[^=]+)(?=\son\sencoder)

usage:

your base search | rex "(?<cam_name>[^=]+)(?=\son\sencoder)"

kdb8916
Explorer

Yes that would be consistent with the other Rex commands I was using ... my apologies for that oversight and I thank you both for your assistance.

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

When using the Rex command, the regular expression must be in quotes.

0 Karma

kdb8916
Explorer

That didn't seem to translate correct once I hit the post comment button ... note that I did use the slashes '\' that you suggested in your reply.

0 Karma

kdb8916
Explorer

Thank you for your response.

When I run that code I am getting an error msg - Error in 'SearchParser': Missing a search command before '^'.

The total snippet that I entered in my existing query based on your input was: rex field=_raw (?[^=]+)(?=\son\sencoder)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...