Splunk Search

Rex, Regex and Field Extraction Question

MHS
Explorer

I know this is going to be something simple and probably the fact that I'm posting this will trigger something in my dome. But here goes:
Here is what my data looks like:
Apr 20 15:36:43 10.200.1.22 1794246290: Called Party Number i = 0x80, '12858'
Apr 20 15:36:42 10.200.1.22 1794246273: Called Party Number i = 0xA1, '314255####'
Note: #### is to redact for privacy

So I want to do a search line extract for anything between the ' '. My regex should look like this: '\d{5,10}'
when I put this line into spunk to extract that field I just get a blank for the field dialed number:
"Called Party Number i" | rex "'\d{5,10}'(?)"

alt text

Suggestions?

Tags (1)
0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

When using named field extractions, the field name goes inside (and before) before the matching group, like:

rex "'(?<dialednumber>\d{5,10})'"

View solution in original post

sowings
Splunk Employee
Splunk Employee

When using named field extractions, the field name goes inside (and before) before the matching group, like:

rex "'(?<dialednumber>\d{5,10})'"

MHS
Explorer

Thanks for the response. That took care of it.

0 Karma

sowings
Splunk Employee
Splunk Employee

Yeah, I forgot about double escaping my \'s.

0 Karma

cphair
Builder

@MHS, note that you also need a backslash before the d to make it match a digit. You also may need to escape (backslash) the single quotes, but I don't have data handy to test that.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Tech Talk Recap   From Chaos to Control: Scaling Splunk Cloud with Infrastructure as Code Managing apps in ...