Rex help

[smineo]

Hi, I have a search result with the field message.log, and the field contains this example pattern

/opt/out/instance/log/audit.log 2023-06-04 21:32:59,422| tid:c-NMqD-hKsPm_AEzEJQyGx4O1kY| SSO| 8e4567c0-9f3a-25a1-a22d-e6b3744559a52| 123.45.678.123 | | this-value-here| SAML20| node1-1.nodeynode.things.svc.cluster.local| IdP| success| yadayadaAdapter| | 285

I'd like to rex "this-value-here" which is always preceded by the pattern pipe-space-pipe-space and always followed by pipe-space-SAML20.

Having trouble with the rex expression, appreciate the assistance.

[inventsekar]

Hi @smineo .. Rich's rex working perfectly..  

| makeresults |eval log="/opt/out/instance/log/audit.log 2023-06-04 21:32:59,422| tid:c-NMqD-hKsPm_AEzEJQyGx4O1kY| SSO| 8e4567c0-9f3a-25a1-a22d-e6b3744559a52| 123.45.678.123 | | this-value-here| SAML20| node1-1.nodeynode.things.svc.cluster.local| IdP| success| yadayadaAdapter| | 285" 
| rex field=log "\| \|(?<value>[^\|]+)" |table log value

[richgalloway · Accepted solution]

I quick test in regex101.com produced this regular expression.

\| \|(?<value>[^\|]+)\| SAML20

[smineo]

Great, thanks. Could you tell me what you did there to get that?

[richgalloway]

It's simple, really, since we know what precedes and follows the desired field.  Just put the known text into the regular expression and add a named capture group between them.  The pattern for the capture group can be either a non-greedy match of anything (.*?) or match anything that is not what follows the field ([^\|]+).