Splunk Search

field extraction with rex

borisk95
New Member

Field sample: <"Data Name='Description'>Microsoft ® Console Based Script Host"<"/Data">

| rex ""(?[a-zA-Z0-9.: \\]+)<\/Data> 
| rex (?[a-zA-Z0-9.: \\]+)
| rex (?[a-zA-Z0-9.: \\]+)

Missing or malformed messages.conf stanza for SEARCHFACTORY:UNKNOWN_OP__a
using | rex (?\d+)<\/EventID> which does not have <"EventID='something'"> works fine

0 Karma

borisk95
New Member

The error was in case of placing ["'] symbols

0 Karma

borisk95
New Member

| rex (?\w+[a-zA-Z0-9:;'"./\])</\Data>
| lookup sys.csv EventID OUTPUT Description
| stats c by EventID,Date,Description

Unknown search command 'a'.

0 Karma

woodcock
Esteemed Legend

I am making a HUGE guess that the desire is that a field called Description should obtain a value called "Microsoft ® Console Based Script Host" and that other similarly encoded KVPs should be created likewise. If so, try this:

... | eval _raw="<\"Data Name='Description'>Microsoft ® Console Based Script Host\"<\"/Data\">" 
| rex max_match=0 "Data Name='(?<key>[^']+)'\>(?<value>[^\"]+)"
| rex field=value mode=sed "s/^/\"/ s/$/\"/"
| eval _raw = mvzip(key, value, "=")
| kv
0 Karma

borisk95
New Member

""<"Data Name='Image'">C:\Program Files\Splunk\bin\splunkd.exe<"/Data">""

| rex field=_raw (?[a-zA-Z0-9.: \]+)<\/Data>

this is my example

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What is your question? What field(s) are you trying to extract?
Please edit your question to restore the regular expressions. Don't change the indentation.

---
If this reply helps you, Karma would be appreciated.
0 Karma

borisk95
New Member

""<"Data Name='Image'">C:\Program Files\Splunk\bin\splunkd.exe<"/Data">""

| rex field=_raw (?[a-zA-Z0-9.: \]+)<\/Data>

this is my example

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...