Splunk Search

Why does regex keeps extracting wrong data?

jhilton90
Path Finder

I am trying to use the rex command to extract an id number, which is a mixture of letters and numbers separated by a dash. For example, one of the ids looks like this:

34gv564-3333-5tg4-gt53-4rgt5eg5g35gb

The field itself is as follows: MFA challenge succeeded for account aaaaaaaaa with email example@example.co.uk. Session id is 34gv564-3333-5tg4-gt53-4rgt5eg5g35gb

The rex command I'm using is as follows:

 

| rex "(?i) is (?<id_number>[^\"]+)"

 

The only problem is that sometimes it extracts the email address bit too

Any help would be greatly appreciated

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

To avoid extracting data from the wrong place, the regex should be more specific.

| rex "Session id is (?<id_number>[^\"]+)"

Since we only have a partial event to work with (the regex implies something in quotes follows, but it's not in the example event), it's impossible to know if there is a better way to extract the field.

---
If this reply helps you, Karma would be appreciated.
0 Karma

karu0711
Communicator

try this

| rex ^(?<id_number>.+)

0 Karma

jhilton90
Path Finder

That just extracts the entire event unfortunately

Thanks anyway though

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...