I'm looking for the regular expression wizards out there. I need to do a rex with two capture groups: one for name, and one for value. I plan to use the replace function, and throw everything else away but those two capture groups (e.g., "\1: \2").
Here are some sample events.
name="Building",value="Southwest",descendants_action="success",operation="OVERRIDE"
name="Building",value=["Northeast","Northwest"],descendants_action="failure",operation="OVERRIDE"
name="Building",value="Southeast",descendants_action="success",operation="OVERRIDE"
name="Building",value="Northwest"
name="Building",value="Northwest",operation="OVERRIDE"
So far I just have this.
^name=\"(.*)\",value=\[?(.*)\]?
Any ideas?
Try something along these lines
^name=\"([^\"]*)\",value=(\[([^\]]+)\]|\"[^\"]+\")(.*)
Try something along these lines
^name=\"([^\"]*)\",value=(\[([^\]]+)\]|\"[^\"]+\")(.*)
Hi @ejwade,
you should already have these extractions because usually Splunk identifies the groups fieldname=fieldvalue.
Anyway, please try this regex:
name\=\"(?<name>[^\"]*)\",value\=\[*\"(?<values>[^\"]*)
that you can test at https://regex101.com/r/PEszES/1
Ciao.
Giuseppe