rex - Extracting a string

[jrowland1230]

I want to exact a string 'GUID" from the log right after "customers". This regex expression works in https://regex101.com/ but not in Splunk.  My field name is log:

2023-06-19 15:28:01.726 ERROR [communication-service,6e72370er2368b08,6e723709fd368b08] [,,,] 1 --- [container-0-C-1] c.w.r.acc.commservice.sink.ReminderSink : Reminder Message processed, no linked customers aaf60d69-99a9-41f5-a081-032224284066

| rex field=log "(?<cids>).*customers\s(.*)"

[P_vandereerden · Accepted solution]

Did you want cids to contain that GUID?

Try

| rex field=log ".*customers\s(?<cids>.*)"

Alternatively, if the GUID is always at the end, following a space, you can even drop the "customers" part:

| rex field=log "(?<cids>\S+$)"

Your example appears to be creating a capture group named "cids" that captures nothing (the first set of parentheses), and then a second non-capturing group that matches what you want (the second set of parentheses).
This document might help explain in more detail:
https://docs.splunk.com/Documentation/SCS/current/Search/AboutSplunkregularexpressions#Capture_group... 

[jrowland1230]

So to clarify the <cids> is the placeholder for the values produced from the regex AND also the placement is where the actual value would be contained in the string, i.e. Log field?

[P_vandereerden]

Yes. You can name multiple capture groups in one rex statement. 

e.g.

| rex field=my_field "foo:\s+\"(?<first_capture>[^\"]+)\",\s+bar:\s+(?<second_capture>[^\"]+)"

[jrowland1230]

Thank you. I was close ugh.