Splunk Search

How to develop a regular expression to use with a field extraction?

hegeman1982
Engager

I am trying to come up with a regular expression to use with the field extractor that would return the value of a string between two strings. The basic formatting is the following:

[nls-string-val raw="Temperature (1) - Rack 4 Back Door Top">Temperature (1) - Rack 4 Back Door Top[/nls-string-val]

I would want the field extractor regex to return the following: Temperature (1) - Rack 4 Back Door Top">Temperature (1) - Rack 4 Back Door Top

*the '[' symbols above are actually '<' symbols but this forum would not let me post links. *
I was trying to use lookbehind and lookahead but was not having any success.

Any tips for how to accomplish this? The REGEX I have tried is "[nls-string-val raw="(.*)<\/nls-string-val>) and it doesn't work"

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@hegeman1982 - Just so you know, there is special markup language on this site so certain symbols will transform your post, such as the < symbols. If you wish to show the < (i.e. you are displaying sample code or regular expressions), simply click on the Code Sample icon to the right of the Blockquote icon in the formatting toolbar.

somesoni2
Revered Legend

Give this a try (test it in a search using inline rex command before putting in props.conf)

your base search | rex "nls-string-value raw=\"(?<FieldName>[^\<]+)\<\/nls-string-val" 
0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...