I'm facing a problem with rex and working through many many threads which didn't help me to solve this issue.
I have logs with attribute based xml (xacml) and want to extract a value, which can be found after 2 special key-phrases in 2 lines.
Here is an log example, which should help to understand this issue.
Well, I can get every value by this simple rex-command.
rex maxmatch=0 "string\">"(?<parameter>.?)<_/xacml-ctx:AttributeValue>
But I only need *value2, which can clearly identified by the name "function2**" in the line above.
By other examples i know this rex command should start with:
rex field=_raw ".*function2(?:\n|.)*
(?:\n|.)* matches any sequence of characters, including a newline.
Next is a kind of verify/bridge-statement.
(?=string\">) checks that the previous expression is followed by
string\"> , without "eating up" the match, so it is left for the next expression to pick up
And last my known search and extract string.
But putting all parts together doesn't work.
rex field=raw ".*function2(?:\n|.)*(?=string\">)"string\">"(?<parameter>.*?)</xacml-ctx:AttributeValue>"
What's the reason? Could it be a simple probleme of connecting statements together?
Hey dineshraj9, thanks for your reply and input.
Your statement didn't worked, but it helped me to shorten the end.
And i tried some other modifier based on the core of your statement
and finally i got one working, but often with incorrect results.
| rex (?s)"function2(p:\n|.).+string\">(?<_parameter>[^<]+)" (without _)
... | rex "(?ms)AttributeID=\"function2\".*?string\">(?<parameter>.*?)<\/xacml-ctx:AttributeValue>"
The key is the
(?ms) part which says to work multi-line and to consider newlines as matching the
hey woodcock, also thanks for your reply and input.
I got it running and correct working with a shorter version based on your input.
| rex "(?s)function2.*?string\">(?<_parameter>[^<]+)" (without _)
m part is implied by default when using
rex in splunk, so it is redundant, but it helps to have it there for commentary's sake (and so that it works when you use other tools such as
regex101.com, etc.). Be sure to
upvote any helpful answers and click
Accept on the best one.
@woodcock's answer should work fine. If not, here's another way of looking at it. Pull out the parameters as a multivalue field, pull out the attributes as a multivalue field, zip them together, then extract only the one combo we want.
| rex max_match=0 "string\">"(?<parameter>.*?)\</xacml-ctx:AttributeValue>" | rex max_match=0 "AttributeId\"(?<myID>[^\"]+)\" " | eval temp=mvzip(myID,parameter,"!!!!") | rex field=temp "^function2!!!!(?<parameter>.*)"
Initially I had an
mvfilter command in there to kill the ones we didn't want, but then I realized it wasn't needed because we could code the
rex to extract only the one we wanted.