Hi folks,
could you please anyone help me to write the regex for below statement and need extract the external value from below logs.
EXTERNAL:10.23.9.121/587327
Try
... my search here | rex field=_raw "EXTERNAL:(?<EXTERNAL>\d+\.\d+\.\d+\.\d+\/\d+)"
You can see it works in this example at regex101.com.
Give this a try:
|rex field=_raw "EXTERNAL\:(?P<EXTERNAL>.[^\s]*)"
thank for the information adayton and i tried with above search and not receiving any value under the External.
AFAIK shouldn't have to use a backward slash on colons.
adayton and zanb , the below command is working fine.
rex field=_raw "EXTERNAL:(?P.[^\s]*)"
Can you provide a sample of the raw log, please?