Splunk Search

How to escape the end bracket using rex?

rbdev
Engager

I've read the threads on escaping the parens and the such. But I'm trying to do the "]". I thought I would be able to just swap the ")" for "]" in the rex command but it doesn't work.

Line: ....[Status: 4] [myfield2: myvalue2][myfield3:myvalue3] [myfield4:myvalue4]

So I've tried the following to extract field2 as value2. The closest one I get is the first and second one. I get the field to extract, but it doesn't cut off on the "]" after it (so the values look like: myvalue2][myfield3:myvalue3] [myfield4:myvalue4])

rex field=_raw "myfield2: (?<myextractvalue2>.*)\\]"

rex field=_raw "myfield2: (?<myextractvalue2>.*)\]"

rex field=_raw "myfield2: (?<myextractvalue2>\w)\\]"

Any help would be greatly appreciated. Thanks.

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Try:

rex field=_raw "myfield2:\s*(?<myextractvalue2>[^\]]*)"

or

rex field=_raw "myfield2:\s*(?<myextractvalue2>.*?)\]"

View solution in original post

poete
Builder

Hello,

this should do :

| makeresults 
| eval someField="[Status: 4] [myfield2: myvalue2][myfield3:myvalue3] [myfield4:myvalue4]"
| rex field=someField "myfield2: (?<myextractvalue2>[A-Za-z0-9]+)" 
| rex field=someField "myfield3:(?<myextractvalue3>[A-Za-z0-9]+)"
| rex field=someField "myfield4:(?<myextractvalue4>[A-Za-z0-9]+)"
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Try:

rex field=_raw "myfield2:\s*(?<myextractvalue2>[^\]]*)"

or

rex field=_raw "myfield2:\s*(?<myextractvalue2>.*?)\]"

rbdev
Engager

EXCELLENT!! Thank you! The second actually worked better for me. The first one sometimes cut the value for some reason. But the second one perfect!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...