Regex Help

[jacqu3sy]

Hi,

I need a regex to extract at search time the values after ACTION[*] and up to the next character, regardless of whether its in quotes or not. So the values "100", or 'alter user blah identified by *' from the following examples;

ACTION:[3] "100" RETURNCODE:[1]
ACTION :[32] 'alter user scott identified by *' DATABASE

Thanks.

[tiagofbmm · Accepted solution]

Hey

Try this

| rex field=_raw "ACTION\s\:\[\d+\]\s(?<YourFiledName>[\'|\"][^\'|\"]*[\'|\"])"

[jacqu3sy]

It nearly worked, extracted out the 'alter user scott identified by *' ok, but I didnt get "100" back as a value...

[tiagofbmm]

Yes, I missed a * in the first \s:

 | rex field=_raw "ACTION\s*\:\[\d+\]\s(?<YourFiledName>[\'|\"][^\'|\"]*[\'|\"])"

[jacqu3sy]

Awesommmmmmme.

Worked perfectly. Many thanks.