Using rex to extract a string from an inner starting delimiter to a unique ending delimiter

[jimm]

So I have events that have the following consistent layout:

{value=1, key=a}, {value=2, key=b}, {value=3, key=c}, {value=4, key=d}, {value=the good stuff, key=desired}, {value=5, key=e}, [and so on]

Each key is unique (no repeats) but the order is not reliable. For example, Key B may come after key D sometimes.

Using the above sample, I'm looking to extract "the good stuff" from the event, but the unique sign-post to find it - the phrase "key=desired" - comes after the desired data. Is it possible for rex to extract a string using a single unique delimiter on the end and beginning at the nearest open-curly-brace?

[jimm · Accepted solution]

Sorry to answer my own question, but hopefully this will be useful to someone.

The answer is to instruct rex not accept extracts with pair-delimiters. In my case, the presence of curly braces would indicate that a value was "greedy" and including other pairs of keys and values. Here's an example of a rex statement that focuses in on the value that I was shooting for.

rex "{value=(?<varName>[^{}]+?), key=desired" 

There may be more efficient ways to accomplish this. This also presumes clean data, such that the delimiters (curly braces in my case) do not occur within valid data. For simplicity in syntax, I didn't specify fields or other optional features to make rex/splunk work better.

[richgalloway]

@jimm, if your problem is resolved, please accept the answer to help future readers.

[jimm]

Will do. Sorry for the oversight.