Splunk Search

Why would the rex command ignore special characters in a search?

skhprabu
New Member

I have my log like

params=All Items | ABC | 2019-01-29 |  |  |  |  |  |  | = |  | = |  |  |  |  |  | ,uri=/api/items

this is my rex field in search

rex field=_raw"params\=(?<parameters>[^=]+)(?=\,uri)"

I expect parameters to save everything between "params=" and ",uri=/api/items"

parameters=All Items | ABC | 2019-01-29 |  |  |  |  |  |  | = |  | = |  |  |  |  |  |

but when i perform search it completel ignores all characters after equals to (=) symbol and shows only

All Items | ABC | 2019-01-29 |  |  |  |  |  |  | 

how should i fix my rex to include = as part of my search result

0 Karma
1 Solution

Vijeta
Influencer

Use the below rex command

rex field=_raw "params=(?<parameters>.*),uri="

View solution in original post

0 Karma

woodcock
Esteemed Legend

Use this instead:

... | rex "params\=(?<parameters>.+?)(?=\,uri)"

OR

... | rex "params\=(?<parameters>.+)\,uri="
0 Karma

Vijeta
Influencer

Use the below rex command

rex field=_raw "params=(?<parameters>.*),uri="
0 Karma
Get Updates on the Splunk Community!

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...

Splunk Observability Cloud | Enhancing Your Onboarding Experience with the ...

We understand that your initial experience with getting data into Splunk Observability Cloud is crucial as it ...