Splunk Search
Highlighted

What is the regular expression to extract the field from my raw event?

Builder

Hi

How to extract the bolded field below from my raw event. It will the anything after msg=(Action: Connect). Any suggestions?

30 11:39:33 CEF:0|Cyber-Ark|Vault|9.70.0020|308|Use Password|5|act=Use Password suser= fname= dvc=1shost=111.22.0.3 dhost=1123 duser= externalId= app= reason= cs1Label="Affected User Name" cs1= cs2Label="Safe Name" cs2=PSMUnmanagedSessionAccounts cs3Label="Device Type" cs3=PSM Secure Connect cs4Label="Database" cs4= cs5Label="Other info" cs5=111.12.13 cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2=(Action: Connect)INC1134557- Patching for Systems msg=(Action: Connect)INC1134557- Patching for Systems

Highlighted

Re: What is the regular expression to extract the field from my raw event?

Explorer

rex field=_raw "msg=\(Action: Connect\)(?P< mymsg >.*)"

There is no spaces between < and mymsg and >

0 Karma
Highlighted

Re: What is the regular expression to extract the field from my raw event?

Builder

I got this Error.

Error in 'rex' command: Encountered the following error while compiling the regex 'msg=(Action: Connect)(?P< mymsg >.*)': Regex: letter or underscore expected after (?< or (?'

0 Karma
Highlighted

Re: What is the regular expression to extract the field from my raw event?

Explorer

Kiran,
You need to remove the spaces after < and before > it is some format issue in the post.

0 Karma