Splunk Search

regex to fetch a particular field available in different places in different events

dtccsundar
Path Finder

I have a field( version) which is available in different position in different events of same sourcetype,Since the prior field(description) to this has irregular count of characters .Due to this is am seeing null values wherever the field(version) in different positions.

I would want fetch the field(version) wherever the field is available in the events of sourcetype.I tried the below ,

| rex field=_raw "Version=(?<Version>\"\w+\s+\w+\".*?)," | rex mode=sed field=Version "s/\\\"//g"

but it didn't worked .Please suggest me a way to fetch this .

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like the rex should work except when the field is not followed by a comma.

Can you provide some sample events of both working and not working cases?

0 Karma

dtccsundar
Path Finder

Please let me know if you require more info on this .

0 Karma

dtccsundar
Path Finder

It works here,Actually it gives data normally without regex

11/23/21 2:12:05.169 AM 2021-11-23 02:12:05.169, Name="LS4J4XMV2", DN="LS4J4XMV2.corp.mtnn.com", Factor="Laptop", Tag="121907", Company="MTNN", Status="Installed",Group="End User Support", Location="WFH", OS="Windows 10 Enterprise", Last_Discovered_On="2021-11-19 12:43:56", IP_Address="172.29.120.28", Number="4J4XMV2", Class="Computer", Domain="global", IT_Status="Active", Discoverable="true", sysid="0045134fdb75f34829a475fb8c961929", Assigned_To="Sandro", Comments="2021-02-23: 'In Transit' - Device is defective and being returned to office by user.", Version="32.35.0", F_IP_Address="192.168.0.251", F_Agent_ID="oz2cqkQi7eddOhEwvZX", F_Last_Audit="2021-11-18 02:27:47.0000000", Polled_On="2021-11-18 02:27:42.0000000", Reporting_Status="Reporting", _Match_Type="FQDN", _Match_ITAM="LS4J4XMV2", _Match_Tool="LS4J4XMV2", _IngestionID="F1685D71-751B-461A-8146-EBF51C71BEF5"

This not gives actual version after using regex too .It gives blank after filling null 

11/23/21 2:12:04.916 AM 2021-11-23 02:12:04.916, Name="LS8N4YPQ2", DN="LS8N4YPQ2.corp.mtnn.com", Factor="Laptop", Tag="148237", Status="Installed", Group="End User Support", Location="MNP01-108", OS="Windows 10 Enterprise", Last_Discovered_On="2021-11-19 07:51:29", IP_Address="172.29.119.234", Number="8N4YPQ2", Class="Computer", Domain="global", IT_Status="Active", Discoverable="true", sysid="0007f529dbe0e3c49d109ee8db96194e", Assigned_To="Leonard", Description="2019-09-13 No recent discovery. LS8N4YPQ2 not in McAfee ePO. Setting status to "In Stock"", Version="32.35.0", F_IP_Address="192.168.24.11", F_Agent_ID="h7r8wz0zFCfdbvcu4xc", F_Last_Audit="2021-11-19 16:52:56.0000000", Polled_On="2021-11-19 17:22:54.0000000", Reporting_Status="Reporting", _Match_Type="FQDN", _Match_ITAM="LS8N4YPQ2", _Match_Tool="LS8N4YPQ2", _IngestionID="C4432752-1B32-4799-8204-3B966AB115B0"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Neither of these version strings would be picked up by your rex expression since they don't have spaces in.

Since you go on to remove the double quotes, why not not capture them in the first place?

| rex "Version=\"(?<Version>[^\"]+)\""
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...