Splunk Search

Rex, Regex and Field Extraction Question

MHS
Explorer

I know this is going to be something simple and probably the fact that I'm posting this will trigger something in my dome. But here goes:
Here is what my data looks like:
Apr 20 15:36:43 10.200.1.22 1794246290: Called Party Number i = 0x80, '12858'
Apr 20 15:36:42 10.200.1.22 1794246273: Called Party Number i = 0xA1, '314255####'
Note: #### is to redact for privacy

So I want to do a search line extract for anything between the ' '. My regex should look like this: '\d{5,10}'
when I put this line into spunk to extract that field I just get a blank for the field dialed number:
"Called Party Number i" | rex "'\d{5,10}'(?)"

alt text

Suggestions?

Tags (1)
0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

When using named field extractions, the field name goes inside (and before) before the matching group, like:

rex "'(?<dialednumber>\d{5,10})'"

View solution in original post

sowings
Splunk Employee
Splunk Employee

When using named field extractions, the field name goes inside (and before) before the matching group, like:

rex "'(?<dialednumber>\d{5,10})'"

MHS
Explorer

Thanks for the response. That took care of it.

0 Karma

sowings
Splunk Employee
Splunk Employee

Yeah, I forgot about double escaping my \'s.

0 Karma

cphair
Builder

@MHS, note that you also need a backslash before the d to make it match a digit. You also may need to escape (backslash) the single quotes, but I don't have data handy to test that.

0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...