Splunk Search

Using rex to extract a string from an inner starting delimiter to a unique ending delimiter

Explorer

So I have events that have the following consistent layout:

{value=1, key=a}, {value=2, key=b}, {value=3, key=c}, {value=4, key=d}, {value=the good stuff, key=desired}, {value=5, key=e}, [and so on]

Each key is unique (no repeats) but the order is not reliable. For example, Key B may come after key D sometimes.

Using the above sample, I'm looking to extract "the good stuff" from the event, but the unique sign-post to find it - the phrase "key=desired" - comes after the desired data. Is it possible for rex to extract a string using a single unique delimiter on the end and beginning at the nearest open-curly-brace?

0 Karma
1 Solution

Explorer

Sorry to answer my own question, but hopefully this will be useful to someone.

The answer is to instruct rex not accept extracts with pair-delimiters. In my case, the presence of curly braces would indicate that a value was "greedy" and including other pairs of keys and values. Here's an example of a rex statement that focuses in on the value that I was shooting for.

rex "{value=(?<varName>[^{}]+?), key=desired" 

There may be more efficient ways to accomplish this. This also presumes clean data, such that the delimiters (curly braces in my case) do not occur within valid data. For simplicity in syntax, I didn't specify fields or other optional features to make rex/splunk work better.

View solution in original post

Explorer

Sorry to answer my own question, but hopefully this will be useful to someone.

The answer is to instruct rex not accept extracts with pair-delimiters. In my case, the presence of curly braces would indicate that a value was "greedy" and including other pairs of keys and values. Here's an example of a rex statement that focuses in on the value that I was shooting for.

rex "{value=(?<varName>[^{}]+?), key=desired" 

There may be more efficient ways to accomplish this. This also presumes clean data, such that the delimiters (curly braces in my case) do not occur within valid data. For simplicity in syntax, I didn't specify fields or other optional features to make rex/splunk work better.

View solution in original post

SplunkTrust
SplunkTrust

@jimm, if your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

Will do. Sorry for the oversight.

0 Karma