Splunk Search

Rex help

smineo
Engager

Hi, I have a search result with the field message.log, and the field contains this example pattern

 

/opt/out/instance/log/audit.log 2023-06-04 21:32:59,422| tid:c-NMqD-hKsPm_AEzEJQyGx4O1kY| SSO| 8e4567c0-9f3a-25a1-a22d-e6b3744559a52| 123.45.678.123 | | this-value-here| SAML20| node1-1.nodeynode.things.svc.cluster.local| IdP| success| yadayadaAdapter| | 285

I'd like to rex "this-value-here" which is always preceded by the pattern pipe-space-pipe-space and always followed by pipe-space-SAML20.

Having trouble with the rex expression, appreciate the assistance.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I quick test in regex101.com produced this regular expression.

\| \|(?<value>[^\|]+)\| SAML20
---
If this reply helps you, Karma would be appreciated.

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

Hi @smineo .. Rich's rex working perfectly..  

| makeresults |eval log="/opt/out/instance/log/audit.log 2023-06-04 21:32:59,422| tid:c-NMqD-hKsPm_AEzEJQyGx4O1kY| SSO| 8e4567c0-9f3a-25a1-a22d-e6b3744559a52| 123.45.678.123 | | this-value-here| SAML20| node1-1.nodeynode.things.svc.cluster.local| IdP| success| yadayadaAdapter| | 285" 
| rex field=log "\| \|(?<value>[^\|]+)" |table log value

rex10thjuly.jpg

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I quick test in regex101.com produced this regular expression.

\| \|(?<value>[^\|]+)\| SAML20
---
If this reply helps you, Karma would be appreciated.

smineo
Engager

Great, thanks. Could you tell me what you did there to get that?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's simple, really, since we know what precedes and follows the desired field.  Just put the known text into the regular expression and add a named capture group between them.  The pattern for the capture group can be either a non-greedy match of anything (.*?) or match anything that is not what follows the field ([^\|]+).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...