Splunk Search

RegEx _raw extraction help

kdb8916
Explorer

I am trying to extract info from the _raw result of my Splunk query. Currently my _raw result is:
_raw="2014-02-13 13:02:10,3,VIDEO_STREAMING,CAMERA_6,\"Video has stopped or is intermittent for camera 6='Tool Corral Rear Aisle' on encoder 192.168.2.101.\"

I would like to extract the Camera Name, which in this case is 'Tool Corral Rear Aisle', from the above _raw string.

Can anyone help?

Thanks so much!

Tags (2)
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

Try this:

(?<cam_name>[^=]+)(?=\son\sencoder)

usage:

your base search | rex "(?<cam_name>[^=]+)(?=\son\sencoder)"

View solution in original post

sbrant_splunk
Splunk Employee
Splunk Employee

Try this:

(?<cam_name>[^=]+)(?=\son\sencoder)

usage:

your base search | rex "(?<cam_name>[^=]+)(?=\son\sencoder)"

kdb8916
Explorer

Yes that would be consistent with the other Rex commands I was using ... my apologies for that oversight and I thank you both for your assistance.

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

When using the Rex command, the regular expression must be in quotes.

0 Karma

kdb8916
Explorer

That didn't seem to translate correct once I hit the post comment button ... note that I did use the slashes '\' that you suggested in your reply.

0 Karma

kdb8916
Explorer

Thank you for your response.

When I run that code I am getting an error msg - Error in 'SearchParser': Missing a search command before '^'.

The total snippet that I entered in my existing query based on your input was: rex field=_raw (?[^=]+)(?=\son\sencoder)

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...