rex command to extract fields from field( Message=Document 345, Microsoft Word Text **owned by** first.last **on** abc1234 **was** some text **on** some text.............)?

[sabithanitg]

rex command to extract fields from Message=Document 345, Microsoft Word Text owned by first.last on abc1234 was some text on some text.............
Marked with bold text are common in all the values.

result of field names should look like this.

DocumentNum=Document 345
DocumentType = Microsoft Word Text
username=first.last
device=abc1234
location=some text

I have started with following rex command, but I cannot look for the text till "owned by" and for user name "owned by" to "on" and so on

| rex Message="(?[^\,])\,(?[()?:owned]*)" | table DocumentNum DocumentType

my result is looking like this: DocumentNum = Document 345
DocumentType = Micro

[stephanefotso · Accepted solution]

yes of course! there are many possibilities to extract what you want. Please which of the above queries worked?
If it is the first one, here you go now:

|rex  "^Message=(?P<DocumentNum>[^,]+),(?P<DocumentType>[^\n]*)owned\sby\s(?P<username>[^ ]+)\s+on\s+(?P<device>[a-f0-9]+)\s+was\s+(?P<location>[^\n]*)"|table DocumentNum DocumentType, username ,device, location

if it is the second one, here you go

|rex field=Message "(?P<DocumentNum>[^,]+),(?P<DocumentType>[^\n]*)owned\sby\s(?P<username>[^ ]+)\s+on\s+(?P<device>[a-f0-9]+)\s+was\s+(?P<location>[^\n]*)"|table DocumentNum DocumentType, username ,device, location

Hope it may help now.

[sabithanitg]

I am using the first one.It worked perfectly.
Thank you very much and appreciate your help.

[stephanefotso]

Hello! Here you go

|rex "^Message=(?P<DocumentNum>[^,]+),\s+(?P<DocumentType>\w+\s+\w+\s+\w+)(?:[^ \n]* ){3}(?P<username>[^ ]+) on (?P<device>[a-f0-9]+) was (?P<location>.+)"|table  DocumentNum,DocumentType, username, device, location

[sabithanitg]

Thanks for the answer Stephane, This is not showing up any value for these fields. Is there any other method to achieve this?

[sabithanitg]

Thanks stephane, With few changes it is working to extract for few values not all of them.
Is there any possibility of extracting all.

For example DocumentType field value contains as below similarly for Location
Microsoft Outlook - Memo Style,
11-02-099.pdf,
https://h44444.www3.hp.com/HPCSN/EtFOnline/fff_ff_notes

[stephanefotso]

try this:

    ..........|rex "^Message=(?P<DocumentNum>[^,]+),\s+(?P<DocumentType>\w+\s+\w+\s+\w+)\sowned\sby\s(?P<username>[^ ]+)\son\s(?P<device>[a-f0-9]+)\swas\s(?P<location>.+)"|table  DocumentNum,DocumentType, username, device, location

And if you are working with a csv file, means Message is a field in your csv, try this:

       ..........|rex field=Message "(?P<DocumentNum>[^,]+),\s+(?P<DocumentType>\w+\s+\w+\s+\w+)\sowned\sby\s(?P<username>[^ ]+)\son\s(?P<device>[a-f0-9]+)\swas\s(?P<location>.+)"|table  DocumentNum,DocumentType, username, device, location

if not working also, please let me see the entire first line of your events.