Splunk Search

Splunk Cloud rex extraction on search

onedarr
New Member
Attempt A index="w3c" | rex field=_raw "?(sessionid=?)\w{8}-\w{4}-\w{4}-\w{4}-\w{12}"  | table  ABC _raw
Attempt B index="w3c" | rex field=_raw "\.\sessionid\=\"(?P)[\w{8}]-[\w{4}]-[\w{4}]-[\w{4}]-[\w{12}]"  | table  ABC _raw
Attempt C index="w3c" | rex field=_raw "\.\sessionid\=\"(?P[\w{8}]-[\w{4}]-[\w{4}]-[\w{4}]-[\w{12}])"  | table  ABC _raw

(I used a named field ABC, it gets cut from this post)

FROM text:

.sessionid=d2a4f0de-747f-413c-a823-03ee7d241d5b&hash

The GOAL:

ABC = d2a4f0de-747f-413c-a823-03ee7d241d5b
0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults
| eval _raw=".sessionid=d2a4f0de-747f-413c-a823-03ee7d241d5b&hash&test"
| rex "sessionid=(?<ABC>.*?)&"

Greedy matching of REGEX is useful.

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw=".sessionid=d2a4f0de-747f-413c-a823-03ee7d241d5b&hash&test"
| rex "sessionid=(?<ABC>.*?)&"

Greedy matching of REGEX is useful.

View solution in original post

0 Karma

codebuilder
SplunkTrust
SplunkTrust

I've posted on this topic previously, but one of the best yet most unknown features of Splunk is "erex".

Pipe the results or your search to erex, and provide a arbitrary name and "examples" (and/or counter-examples) of the value you are trying to extract. Once the search completes, view the job inspector and it will provide you with the proper regex query to extract the field you are after. It is extremely useful! It may not be perfect at first try, but builds the regex for you, then you can tweak and fine tune it (though generally it's pretty spot on).

https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Erex

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

anmolpatel
Builder
| rex field=_raw "(\.sessionid=)(?<ABC>(\w*[\-\&]?)+)"
0 Karma

jscraig2006
Communicator

You can capture all up to the "&". Try this index="w3c"| rex "sessionid\=(?<vns_raw>[^\&]+)" Assuming that vns_raw is the field you are wanting to create. Otherwise you can change it to your needs.

0 Karma

onedarr
New Member

vns was a typo, meant ABC. Thank you for your input, but your expression still returns null for that extracted field. I'm wondering if cloud has some special rules to the rex command? This seems like a bug but I don't have a good way to test in another splunk environment

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!