Splunk Search

Using regex to extract data

jialiu907
Path Finder

I am looking to extract this section of an event and have it as a field that I am able to manipulate with. I am unfamiliar with regex and I am getting the wrong results. 


Events

 

<28>1 2025-02-19T15:14:00.968210+00:00 aleoweul0169x falcon-sensor-bpf 1152 - - CrowdStrike(4): SSLSocket Disconnected from Cloud.
<30>1 2025-02-19T15:14:16.104202+00:00 aleoweul0169x falcon-sensor-bpf 1152 - - CrowdStrike(4): SSLSocket connected successfully to ts01-lanner-lion.cloudsink.net:443

 

 I am looking to have a field called Disconnect based on "SSLSocket Disconnected from Cloud"

Labels (4)
0 Karma
1 Solution

livehybrid
Super Champion

Hi @jialiu907 

Have a look at the below, I've suggested 2 ways you can determine your Disconnect field based on that value, is this what you're after?

| makeresults 
|  eval _raw="<28>1 2025-02-19T15:14:00.968210+00:00 aleoweul0169x falcon-sensor-bpf 1152 - - CrowdStrike(4): SSLSocket Disconnected from Cloud."
| rex "\)\:\s(?<Disconnect>SSLSocket Disconnected from Cloud)"
| eval Disconnect2=IF(searchmatch("SSLSocket Disconnected from Cloud"),1,0)

 

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

View solution in original post

kiran_panchavat
Influencer

@jialiu907 

Check this 

kiran_panchavat_0-1739981630031.png

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

jialiu907
Path Finder

Yes it worked perfectly thank you. Are you able to explain the syntax of the rex if possible?

0 Karma

livehybrid
Super Champion

Sure @jialiu907 

Just to mention, by default rex works on the _raw field, however you can specify field=<fieldName> to run it against a different field.

Breakdown of the rex (regular expression):

  1. \)\:

    • Matches a literal ) followed by a :.
    • The backslash (\) escapes the closing parenthesis ) since it's a special character in regex.
  2. \s

    • Matches a single whitespace character (space, tab, or newline).
  3. (?<Disconnect>SSLSocket Disconnected from Cloud)

    • This is a named capturing group called Disconnect which means it creates your new Splunk field called "Disconnect".
    • It captures the exact phrase "SSLSocket Disconnected from Cloud". - If there is no exact match (Case-Sensitive) then it will not match!
    • The (?<name>pattern) syntax is used to name the capturing group and extract the field.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

livehybrid
Super Champion

Hi @jialiu907 

Have a look at the below, I've suggested 2 ways you can determine your Disconnect field based on that value, is this what you're after?

| makeresults 
|  eval _raw="<28>1 2025-02-19T15:14:00.968210+00:00 aleoweul0169x falcon-sensor-bpf 1152 - - CrowdStrike(4): SSLSocket Disconnected from Cloud."
| rex "\)\:\s(?<Disconnect>SSLSocket Disconnected from Cloud)"
| eval Disconnect2=IF(searchmatch("SSLSocket Disconnected from Cloud"),1,0)

 

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...