rex extract literal stings with special characters

[spicy]

I have a list of hundreds of string values that need to be extracted from a field

the problem is the values that need to be extracted contain special characters i.e. (\, $, \\, ^, . . .)

Is there an easy way im missing to extract the literal characters?

what I have tried 
(example list)

| makeresults
| eval raw_field_example = "$money$ "?question?" "help$.." "random" "text"
| makemv raw_field_example delim=" "
| rex field=raw_field_example "(?<literal_items_I_want>"money"|$money$|"text"|"help$..")"

results for literal_items_I_want are only:
money 
text

tried putting the @ symbol before each double quotes but didnt work...

thanks for the help

[spicy · Accepted solution]

Ok I fount the answer...

\Qextract$anythin\gbetween\E|\Qsomethingelse\E

start with a \Q end with \E

and if your extracting a string that contains \E OR \Q you can rex mode=sed replace it to be \e \q prior to extraction, with case sensitivity turned off. 

[manjunathmeti]

hi @spicy,

You can escape special characters using back slash \. You can try this:

| makeresults
| eval raw_field_example = "$money$ question? help$.. random text"
| makemv raw_field_example delim=" " 
| rex field=raw_field_example max_match=0 "(?<literal_items_I_want>\W?\w+\W?)"

If this reply helps you, a like would be appreciated.

[spicy]

The _raw field will be a lot more randomness. The list of strings I am searching is quite complex as well, would not be able to add \ to every string for extraction.

[venkatasri]

Hi @spicy  how is your _raw events looks like can you paste here and what's your requirement which content to be extracted?

--

An upvote would be appreciated if this reply helps!

[spicy]

The _raw is mostly network logs. netflow, all zeek types, 0365, web, and some EDR solutions with enrichment

so its kind of all over the place. 

all formats too, json, csv, tab delimited.