Splunk Search

What is the regular expression to extract the field from my raw event?

Builder

Hi

How to extract the bolded field below from my raw event. It will the anything after msg=(Action: Connect). Any suggestions?

30 11:39:33 CEF:0|Cyber-Ark|Vault|9.70.0020|308|Use Password|5|act=Use Password suser= fname= dvc=1shost=111.22.0.3 dhost=1123 duser= externalId= app= reason= cs1Label="Affected User Name" cs1= cs2Label="Safe Name" cs2=PSMUnmanagedSessionAccounts cs3Label="Device Type" cs3=PSM Secure Connect cs4Label="Database" cs4= cs5Label="Other info" cs5=111.12.13 cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2=(Action: Connect)INC1134557- Patching for Systems msg=(Action: Connect)INC1134557- Patching for Systems

Explorer

rex field=_raw "msg=\(Action: Connect\)(?P< mymsg >.*)"

There is no spaces between < and mymsg and >

0 Karma

Builder

I got this Error.

Error in 'rex' command: Encountered the following error while compiling the regex 'msg=(Action: Connect)(?P< mymsg >.*)': Regex: letter or underscore expected after (?< or (?'

0 Karma

Explorer

Kiran,
You need to remove the spaces after < and before > it is some format issue in the post.

0 Karma