I apologize ahead for this as this is a regex question - one that I have struggled with.
| makeresults
| eval ARN="arn:aws-us-gov:iam::123456789:user/Administrator"
| rex field=ARN "^(?<r_arn>[^:{2}]*)"
| table r_arn
I don't understand why the result of this regex is 'arn' only. I am trying to capture everything up until '::' but it is only capturing up to the first ':'
Any help would be most appreciative. Thank you.
hello there,
the regex tool explains it better than i do:
https://regex101.com/r/HRtqyC/1
try this search:
| makeresults
| eval ARN="arn:aws-us-gov:iam::123456789:user/Administrator"
| rex field=ARN "^(?<r_arn>[^.]*)\:\:"
| table r_arn
hope it helps
@brdr, can you try the following?
| makeresults
| eval ARN="arn:aws-us-gov:iam::123456789:user/Administrator"
| rex field=ARN "^(?<r_arn>[^:]+:[^:]+:[^:]+):"
| table r_arn ARN
thanks @niketnilay... this would work but the string before the '::' can have varying number of ':'. I appreciated your help 🙂
Sure makes sense! Glad that you found a working answer 🙂 regex101 is a great tool to apply/test and understand your regular expression. So keep it handy!
Got it.
I spent a good amount of time in regex101 before posting to Splunk Answers. I always try to figure things out, only using Answers when absolutely necessary.
hello there,
the regex tool explains it better than i do:
https://regex101.com/r/HRtqyC/1
try this search:
| makeresults
| eval ARN="arn:aws-us-gov:iam::123456789:user/Administrator"
| rex field=ARN "^(?<r_arn>[^.]*)\:\:"
| table r_arn
hope it helps
that worked! thank you.