how to write the regular expression for my statement?

[lksridhar]

Hi folks,

could you please anyone help me to write the regex for below statement and need extract the external value from below logs.

EXTERNAL:10.23.9.121/587327

[Richfez]

Try

... my search here | rex field=_raw "EXTERNAL:(?<EXTERNAL>\d+\.\d+\.\d+\.\d+\/\d+)"

You can see it works in this example at regex101.com.

[adayton20 · Accepted solution]

Give this a try:

|rex field=_raw "EXTERNAL\:(?P<EXTERNAL>.[^\s]*)"

[lksridhar]

thank for the information adayton and i tried with above search and not receiving any value under the External.

[zanb]

AFAIK shouldn't have to use a backward slash on colons.

[lksridhar]

adayton and zanb , the below command is working fine.

rex field=_raw "EXTERNAL:(?P.[^\s]*)"

[adayton20]

Can you provide a sample of the raw log, please?