Splunk Search

Rex help

smineo
Engager

Hi, I have a search result with the field message.log, and the field contains this example pattern

 

/opt/out/instance/log/audit.log 2023-06-04 21:32:59,422| tid:c-NMqD-hKsPm_AEzEJQyGx4O1kY| SSO| 8e4567c0-9f3a-25a1-a22d-e6b3744559a52| 123.45.678.123 | | this-value-here| SAML20| node1-1.nodeynode.things.svc.cluster.local| IdP| success| yadayadaAdapter| | 285

I'd like to rex "this-value-here" which is always preceded by the pattern pipe-space-pipe-space and always followed by pipe-space-SAML20.

Having trouble with the rex expression, appreciate the assistance.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I quick test in regex101.com produced this regular expression.

\| \|(?<value>[^\|]+)\| SAML20
---
If this reply helps you, Karma would be appreciated.

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

Hi @smineo .. Rich's rex working perfectly..  

| makeresults |eval log="/opt/out/instance/log/audit.log 2023-06-04 21:32:59,422| tid:c-NMqD-hKsPm_AEzEJQyGx4O1kY| SSO| 8e4567c0-9f3a-25a1-a22d-e6b3744559a52| 123.45.678.123 | | this-value-here| SAML20| node1-1.nodeynode.things.svc.cluster.local| IdP| success| yadayadaAdapter| | 285" 
| rex field=log "\| \|(?<value>[^\|]+)" |table log value

rex10thjuly.jpg

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I quick test in regex101.com produced this regular expression.

\| \|(?<value>[^\|]+)\| SAML20
---
If this reply helps you, Karma would be appreciated.

smineo
Engager

Great, thanks. Could you tell me what you did there to get that?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's simple, really, since we know what precedes and follows the desired field.  Just put the known text into the regular expression and add a named capture group between them.  The pattern for the capture group can be either a non-greedy match of anything (.*?) or match anything that is not what follows the field ([^\|]+).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...