Splunk Search

How do I edit the syntax for my rex expression to extract the field from my sample data?

rgcox1
Communicator

Can't get the following to work:

rex field=updateTitle  "(?<patch>)KB\d*+"

Sample text:

Security Update for Lync 2010 X64 (KB3081087​)
Security Update for Microsoft Office 2010 (KB3054965) 32-Bit Edition
Update for Microsoft Office 2010 (KB3055042) 32-Bit Edition
Windows Malicious Software Removal Tool x64 - September 2015 (KB890830)
Update for Microsoft PowerPoint 2010 (KB3085513) 32-Bit Edition
Update for Microsoft Office 2010 (KB3055047) 32-Bit Edition
Security Update for Microsoft .NET Framework 4.5, 4.5.1 and 4.5.2 on Windows 7, Vista, Server 2008, Server 2008 R2 x64 (KB3074550)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this

rex field=updateTitle "(?<patch>KB\d+)"

OR

rex field=updateTitle "((?KB\d+)"

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

rex field=updateTitle "(?<patch>KB\d+)"

OR

rex field=updateTitle "((?KB\d+)"

0 Karma

rgcox1
Communicator

Thx. Moving closing paren to end worked:

 rex field=updateTitle  "(?<KBnum>KB\d*+)"
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...