Splunk Search

regex to fetch a particular field available in different places in different events

dtccsundar
Path Finder

I have a field( version) which is available in different position in different events of same sourcetype,Since the prior field(description) to this has irregular count of characters .Due to this is am seeing null values wherever the field(version) in different positions.

I would want fetch the field(version) wherever the field is available in the events of sourcetype.I tried the below ,

| rex field=_raw "Version=(?<Version>\"\w+\s+\w+\".*?)," | rex mode=sed field=Version "s/\\\"//g"

but it didn't worked .Please suggest me a way to fetch this .

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like the rex should work except when the field is not followed by a comma.

Can you provide some sample events of both working and not working cases?

0 Karma

dtccsundar
Path Finder

Please let me know if you require more info on this .

0 Karma

dtccsundar
Path Finder

It works here,Actually it gives data normally without regex

11/23/21 2:12:05.169 AM 2021-11-23 02:12:05.169, Name="LS4J4XMV2", DN="LS4J4XMV2.corp.mtnn.com", Factor="Laptop", Tag="121907", Company="MTNN", Status="Installed",Group="End User Support", Location="WFH", OS="Windows 10 Enterprise", Last_Discovered_On="2021-11-19 12:43:56", IP_Address="172.29.120.28", Number="4J4XMV2", Class="Computer", Domain="global", IT_Status="Active", Discoverable="true", sysid="0045134fdb75f34829a475fb8c961929", Assigned_To="Sandro", Comments="2021-02-23: 'In Transit' - Device is defective and being returned to office by user.", Version="32.35.0", F_IP_Address="192.168.0.251", F_Agent_ID="oz2cqkQi7eddOhEwvZX", F_Last_Audit="2021-11-18 02:27:47.0000000", Polled_On="2021-11-18 02:27:42.0000000", Reporting_Status="Reporting", _Match_Type="FQDN", _Match_ITAM="LS4J4XMV2", _Match_Tool="LS4J4XMV2", _IngestionID="F1685D71-751B-461A-8146-EBF51C71BEF5"

This not gives actual version after using regex too .It gives blank after filling null 

11/23/21 2:12:04.916 AM 2021-11-23 02:12:04.916, Name="LS8N4YPQ2", DN="LS8N4YPQ2.corp.mtnn.com", Factor="Laptop", Tag="148237", Status="Installed", Group="End User Support", Location="MNP01-108", OS="Windows 10 Enterprise", Last_Discovered_On="2021-11-19 07:51:29", IP_Address="172.29.119.234", Number="8N4YPQ2", Class="Computer", Domain="global", IT_Status="Active", Discoverable="true", sysid="0007f529dbe0e3c49d109ee8db96194e", Assigned_To="Leonard", Description="2019-09-13 No recent discovery. LS8N4YPQ2 not in McAfee ePO. Setting status to "In Stock"", Version="32.35.0", F_IP_Address="192.168.24.11", F_Agent_ID="h7r8wz0zFCfdbvcu4xc", F_Last_Audit="2021-11-19 16:52:56.0000000", Polled_On="2021-11-19 17:22:54.0000000", Reporting_Status="Reporting", _Match_Type="FQDN", _Match_ITAM="LS8N4YPQ2", _Match_Tool="LS8N4YPQ2", _IngestionID="C4432752-1B32-4799-8204-3B966AB115B0"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Neither of these version strings would be picked up by your rex expression since they don't have spaces in.

Since you go on to remove the double quotes, why not not capture them in the first place?

| rex "Version=\"(?<Version>[^\"]+)\""
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...