Regex Not Functioning Properly in XQL

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Regex Not Functioning Properly in XQL

L0 Member

Hello everyone, I'm attempting to extract fields from DHCP logs but encounter an error stating, "Your query failed to run as it's invalid." my regex code works correctly on regex101 and CyberChef. Does anyone have any insights on how to troubleshoot the issue?



dataset in(infoblox_infoblox_raw )
|filter _raw_log ~=".*dhcpd.*"
|alter event_raw = _raw_log
|alter pid = arrayindex(regextract(_raw_log , "\[(\d+)\]:") ,0) ,
Infobox_host = arrayindex(regextract(_raw_log , "(?:\s+([^\s]+)\s+)?dhcpd") ,0),
mac_address = arrayindex(regextract(_raw_log , "DHCPDISCOVER\sfrom\s([A-Fa-f\d]{2}(?:[:-][A-Fa-f\d]{2}){5})") ,0) ,

hostname1 = arrayindex(regextract(_raw_log , "DHCPDISCOVER\sfrom\s([A-Fa-f\d]{2}(?:[:-][A-Fa-f\d]{2}){5})\(([^)]+)\)") ,0)

 

|fields hostname1, mac_address, pid, Infobox_host , _raw_log
|limit 100

 

Thanks

1 REPLY 1

L5 Sessionator

Hello @AmirSabei ,

Thanks for reaching out on LiveCommunity!

 

Based on your query it looks like the issue is with Hostname1 field.  The regular expression matches a DHCPDISCOVER message followed by a MAC address and an IP address enclosed in parentheses. Can you confirm exactly what are you looking in hostname1 field?

 

if you run without |fields hostname1 it works fine.

Ashutosh Patil
  • 514 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!