Splunk Search
Highlighted

Why am I unable to extract this field with my current rex statement?

Communicator

I have a regex that should be extracting the employeeType field from an event. Below is the text of the event and the regex I am using.

Details:  
    Attributes:
        employeeType
            Contractor

Search:

mysearch | rex "employeeType\n\t\t\t(?<employeeType>\w+)"

We see the extraction work on regxr, but it doesn't seem to extract in the search.

0 Karma
Highlighted

Re: Why am I unable to extract this field with my current rex statement?

SplunkTrust
SplunkTrust

Try ... | rex "employeeType\s*(?<employeeType>\w+)".

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: Why am I unable to extract this field with my current rex statement?

Communicator

Well now don't I feel silly... Thanks.

0 Karma
Highlighted

Re: Why am I unable to extract this field with my current rex statement?

Splunk Employee
Splunk Employee

Are you sure there are tabs preceding the "employeeType" value? Here's a few suggestions to try:

employeeType\n\t+(?\w+)

If there are tabs prior to the employeeType value, this should account for 1 or more tabs in the regex

employeeType\n\s+(?\w+)

If these are actually spaces, this should work

employeeType\s+(?\w+)

In my quick testing on https://regex101.com, I observed the regex did not need the newline token (\n) - so you could try your regex without it

Hope this helps,
Jamie

0 Karma
Highlighted

Re: Why am I unable to extract this field with my current rex statement?

Communicator

The raw value did not have the newline like the event appears to in the search which is why it worked in my testing because I was using the formatting presented with the search. In any case, richgalloway solved my issue. Thanks for replying!

0 Karma