I'm using the _rex command and I want to create a regular expression that contains a literal double quote character. How do I do this?
Thanks,
Jonathan
Hey try this
you can use \ to escape “
For example
Suppose you have user=“xyz” in the event and you want to extract xyz then you can use below regex
| rex field=_raw “user=\”(?P<user>[^\”])”
You can use regex101.com to learn more !
Let me know if this helps you.
If you provide a sample event and tell us want you want to extract then we can write regex for you !
Provide sample event
You can escape the double-quote by using a backslash. Here's some sample run-anywhere code:
|makeresults
| eval tf="contains a literal quote \" followed by stuff"
| rex field=tf "\"(?<after_quote_stuff>.*)"
Escape it with a . EG if you have foo="bar and you want to extract bar
| rex field=foo "\"(?<bar>[A-z]+)"