Splunk Cloud rex extraction on search

[onedarr]

Attempt A index="w3c" | rex field=_raw "?(sessionid=?)\w{8}-\w{4}-\w{4}-\w{4}-\w{12}"  | table  ABC _raw
Attempt B index="w3c" | rex field=_raw "\.\sessionid\=\"(?P)[\w{8}]-[\w{4}]-[\w{4}]-[\w{4}]-[\w{12}]"  | table  ABC _raw
Attempt C index="w3c" | rex field=_raw "\.\sessionid\=\"(?P[\w{8}]-[\w{4}]-[\w{4}]-[\w{4}]-[\w{12}])"  | table  ABC _raw

(I used a named field ABC, it gets cut from this post)

FROM text:

.sessionid=d2a4f0de-747f-413c-a823-03ee7d241d5b&hash

The GOAL:

ABC = d2a4f0de-747f-413c-a823-03ee7d241d5b

[to4kawa · Accepted solution]

| makeresults
| eval _raw=".sessionid=d2a4f0de-747f-413c-a823-03ee7d241d5b&hash&test"
| rex "sessionid=(?<ABC>.*?)&"

Greedy matching of REGEX is useful.

[codebuilder]

I've posted on this topic previously, but one of the best yet most unknown features of Splunk is "erex".

Pipe the results or your search to erex, and provide a arbitrary name and "examples" (and/or counter-examples) of the value you are trying to extract. Once the search completes, view the job inspector and it will provide you with the proper regex query to extract the field you are after. It is extremely useful! It may not be perfect at first try, but builds the regex for you, then you can tweak and fine tune it (though generally it's pretty spot on).

https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Erex

[anmolpatel]

| rex field=_raw "(\.sessionid=)(?<ABC>(\w*[\-\&]?)+)"

[jscraig2006]

You can capture all up to the "&". Try this index="w3c"| rex "sessionid\=(?<vns_raw>[^\&]+)" Assuming that vns_raw is the field you are wanting to create. Otherwise you can change it to your needs.

[onedarr]

vns was a typo, meant ABC. Thank you for your input, but your expression still returns null for that extracted field. I'm wondering if cloud has some special rules to the rex command? This seems like a bug but I don't have a good way to test in another splunk environment