how to extract this fields

[christian75]

When i try to extract BiosMake fields in my log file with field extraction (Mode regex).I have this:Error in 'rex' command: regex="^\w+="\d+\.\d+\.\d+\.\d+"\s+\w+=\w+\d+\s+\w+=\d+\s+\w+=\w+\-\w+\s+\d+\-\w+\s+\w+=\d+\.\d+\s+\w+=\w+\d+\s+\w+\.\s+\d+\.\d+\.\d+\s+\w+=\d+\s+\w+=\d+\w+\d+\s+\d+:\d+:\d+\.\d+\s+\w+=\w+\.\w+\.\w+\\\w+\-\w+\-\w+\d+\w+\s+\w+=\w+\d+\s+\w+\s+\d+\s+\w+\s+\w+=\w+\s+\w+\s+\w+=\w+\d+\s+\w+=(?P<volumeEncryptionState>\w+)" has exceeded configured match_limit, consider raising the value in limits.conf

this is my log:

AgentVersion="2.5.1126.0" ComputerManufacturerName=ASDA3101705 iscompliant=1 policyCipherStrength=AES-CBC 128-Bit TpmVersion=1.4 BiosVersion=N75 Ver. 01.33 Id=292629 LatestEntry=2021May14 14:31:36.077 MachinesUsersNames=eu.airbus.corp\TA-ADMIN-ST40783 OperatingSystemName=ASDA3101705 Windows 10 Enterprise ComputerType=Portable Name=ASDA3101705 volumeEncryptionState=Encrypting TpmMake=IFX  BiosMake=Phoenix Technologies LTD

[gcusello]

Hi @christian75,

if your volumeEncryptionState field hasn't any space in the value, please try this regex

| rex "volumeEncryptionState\=(?<volumeEncryptionState>[^ ]+)"

that you can test at https://regex101.com/r/nejG4v/1

otherwise, please test this:

| rex "volumeEncryptionState\=(?<volumeEncryptionState>.+)\s+TpmMake"

 that you can test at https://regex101.com/r/nejG4v/2

Ciao.

Giuseppe

[ITWhisperer]

Do you not need to escape the embedded double quotes?

regex="^\w+=\"\d+\.\d+\.\d+\.\d+\"\s+\w+=\w+\d+\s+\w+=\d+\s+\w+=\w+\-\w+\s+\d+\-\w+\s+\w+=\d+\.\d+\s+\w+=\w+\d+\s+\w+\.\s+\d+\.\d+\.\d+\s+\w+=\d+\s+\w+=\d+\w+\d+\s+\d+:\d+:\d+\.\d+\s+\w+=\w+\.\w+\.\w+\\\w+\-\w+\-\w+\d+\w+\s+\w+=\w+\d+\s+\w+\s+\d+\s+\w+\s+\w+=\w+\s+\w+\s+\w+=\w+\d+\s+\w+=(?P<volumeEncryptionState>\w+)"

[aasabatini]

Hi @christian75 

I suppose your regex is to heavy and generate and error anyway I suggest to use automatic key value extraction

https://docs.splunk.com/Documentation/Splunk/8.1.3/Knowledge/Automatickey-valuefieldextractionsatsea...

however if you need a new light regex you can use this:

BiosMake=(?<biosmake>[^ ].+)

 hope can help

Ale