Splunk Search

Using regex to extract data

jialiu907
Path Finder

I am looking to extract this section of an event and have it as a field that I am able to manipulate with. I am unfamiliar with regex and I am getting the wrong results. 


Events

 

<28>1 2025-02-19T15:14:00.968210+00:00 aleoweul0169x falcon-sensor-bpf 1152 - - CrowdStrike(4): SSLSocket Disconnected from Cloud.
<30>1 2025-02-19T15:14:16.104202+00:00 aleoweul0169x falcon-sensor-bpf 1152 - - CrowdStrike(4): SSLSocket connected successfully to ts01-lanner-lion.cloudsink.net:443

 

 I am looking to have a field called Disconnect based on "SSLSocket Disconnected from Cloud"

Labels (4)
0 Karma
1 Solution

livehybrid
Super Champion

Hi @jialiu907 

Have a look at the below, I've suggested 2 ways you can determine your Disconnect field based on that value, is this what you're after?

| makeresults 
|  eval _raw="<28>1 2025-02-19T15:14:00.968210+00:00 aleoweul0169x falcon-sensor-bpf 1152 - - CrowdStrike(4): SSLSocket Disconnected from Cloud."
| rex "\)\:\s(?<Disconnect>SSLSocket Disconnected from Cloud)"
| eval Disconnect2=IF(searchmatch("SSLSocket Disconnected from Cloud"),1,0)

 

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

View solution in original post

kiran_panchavat
Influencer

@jialiu907 

Check this 

kiran_panchavat_0-1739981630031.png

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

jialiu907
Path Finder

Yes it worked perfectly thank you. Are you able to explain the syntax of the rex if possible?

0 Karma

livehybrid
Super Champion

Sure @jialiu907 

Just to mention, by default rex works on the _raw field, however you can specify field=<fieldName> to run it against a different field.

Breakdown of the rex (regular expression):

  1. \)\:

    • Matches a literal ) followed by a :.
    • The backslash (\) escapes the closing parenthesis ) since it's a special character in regex.
  2. \s

    • Matches a single whitespace character (space, tab, or newline).
  3. (?<Disconnect>SSLSocket Disconnected from Cloud)

    • This is a named capturing group called Disconnect which means it creates your new Splunk field called "Disconnect".
    • It captures the exact phrase "SSLSocket Disconnected from Cloud". - If there is no exact match (Case-Sensitive) then it will not match!
    • The (?<name>pattern) syntax is used to name the capturing group and extract the field.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

livehybrid
Super Champion

Hi @jialiu907 

Have a look at the below, I've suggested 2 ways you can determine your Disconnect field based on that value, is this what you're after?

| makeresults 
|  eval _raw="<28>1 2025-02-19T15:14:00.968210+00:00 aleoweul0169x falcon-sensor-bpf 1152 - - CrowdStrike(4): SSLSocket Disconnected from Cloud."
| rex "\)\:\s(?<Disconnect>SSLSocket Disconnected from Cloud)"
| eval Disconnect2=IF(searchmatch("SSLSocket Disconnected from Cloud"),1,0)

 

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...