Splunk Search

Rex, Regex and Field Extraction Question

MHS
Explorer

I know this is going to be something simple and probably the fact that I'm posting this will trigger something in my dome. But here goes:
Here is what my data looks like:
Apr 20 15:36:43 10.200.1.22 1794246290: Called Party Number i = 0x80, '12858'
Apr 20 15:36:42 10.200.1.22 1794246273: Called Party Number i = 0xA1, '314255####'
Note: #### is to redact for privacy

So I want to do a search line extract for anything between the ' '. My regex should look like this: '\d{5,10}'
when I put this line into spunk to extract that field I just get a blank for the field dialed number:
"Called Party Number i" | rex "'\d{5,10}'(?)"

alt text

Suggestions?

Tags (1)
0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

When using named field extractions, the field name goes inside (and before) before the matching group, like:

rex "'(?<dialednumber>\d{5,10})'"

View solution in original post

sowings
Splunk Employee
Splunk Employee

When using named field extractions, the field name goes inside (and before) before the matching group, like:

rex "'(?<dialednumber>\d{5,10})'"

MHS
Explorer

Thanks for the response. That took care of it.

0 Karma

sowings
Splunk Employee
Splunk Employee

Yeah, I forgot about double escaping my \'s.

0 Karma

cphair
Builder

@MHS, note that you also need a backslash before the d to make it match a digit. You also may need to escape (backslash) the single quotes, but I don't have data handy to test that.

0 Karma
Get Updates on the Splunk Community!

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...