×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
adamsobczykhsbc
Explorer
Member since: ‎02-12-2024
‎02-13-2024
Community Statistics
Posts 3
Solutions 1
Karma Given 0
Karma Received 0
Member Since ‎02-12-2024
View All

Re: How to use rex to extract field before two sym...

by in Splunk Search
‎02-13-2024 06:00 AM
‎02-13-2024 06:00 AM
I just figured it out with guidance from https://stackoverflow.com/questions/7124778/how-can-i-match-anything-up-until-this-sequence-of-characters-in-a-regular-exp  correct rex will be |rex field=_raw "Error\=(?<ErrDesc>.+?(?=\|\"))" thanks for help! ... View more

Re: How to use rex to extract field before two sym...

by in Splunk Search
‎02-13-2024 05:43 AM
‎02-13-2024 05:43 AM
Hi @gcusello , it works for that specific case, however my extracted field ErrDesc will not always have pipe "|" inside, basically I want to match anything until |" , no matter if pipe is in the field or not ... View more

How to use rex to extract field before two symbols

by in Splunk Search
‎02-13-2024 05:28 AM
‎02-13-2024 05:28 AM
I have raw data like:     Error=REQUEST ERROR | request is not valid.|","time":"1707622073040"     and I want to extract "REQUEST ERROR | request is not valid." to a new field, so I try to use rex to match until |" with below query but it still only returns "REQUEST ERROR"     |rex field=_raw "Error\=(?<ErrDesc>[^|\"]+)"       ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎02-13-2024 09:32 AM