Splunk Search

Splunk Regular Expression


I am trying to extract a filed using. | rex field=_raw
I used regexr to create a regular expression with an exclude group and a capture group.
I have this working, but can't seem to format this for Splunk.
Any good tips for Regex and Splunk?
Regex I am using:

 (?:<entry key="applications" value=")([a-zA-Z0-9 ]+)(?:"\/>)

String extracting the value from:

<entry key="applications" value="AD Users"/>

Any help you can provide is greatly appreciated.


0 Karma


Your regex string doesn't contain field extractions so the rex command is not doing anything for you. Another factor is the rex command requires quotation marks be escaped. See if this helps you.

... | rex "<entry key=\"applications\" value=\"(?<appValue>[a-zA-Z0-9 ]+)\"\/>" | ...
If this reply helps you, an upvote would be appreciated.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!