Splunk Search

What is the regular expression to extract the field from my raw event?

kiran331
Builder

Hi

How to extract the bolded field below from my raw event. It will the anything after msg=(Action: Connect). Any suggestions?

30 11:39:33 CEF:0|Cyber-Ark|Vault|9.70.0020|308|Use Password|5|act=Use Password suser= fname= dvc=1shost=111.22.0.3 dhost=1123 duser= externalId= app= reason= cs1Label="Affected User Name" cs1= cs2Label="Safe Name" cs2=PSMUnmanagedSessionAccounts cs3Label="Device Type" cs3=PSM Secure Connect cs4Label="Database" cs4= cs5Label="Other info" cs5=111.12.13 cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2=(Action: Connect)INC1134557- Patching for Systems msg=(Action: Connect)INC1134557- Patching for Systems

GersonGarcia
Path Finder

rex field=_raw "msg=\(Action: Connect\)(?P< mymsg >.*)"

There is no spaces between < and mymsg and >

0 Karma

kiran331
Builder

I got this Error.

Error in 'rex' command: Encountered the following error while compiling the regex 'msg=(Action: Connect)(?P< mymsg >.*)': Regex: letter or underscore expected after (?< or (?'

0 Karma

GersonGarcia
Path Finder

Kiran,
You need to remove the spaces after < and before > it is some format issue in the post.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...