IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Some issue in Regex Capture Group.

    Posted 09/29/20 12:00 PM
    I am extracting the Property for the field, The field is as follows FailureReason=12514 EAP-TLS failed SSL/TLS handshake because of an unknown CA in the client certificates chain

    The Regex is as follows Failure.+?(?=\,) and the capture group category has been taken as 1, and the issue is that i am getting the Invalid Capture Group.

    Please solve the issue.



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: Some issue in Regex Capture Group.

    Posted 10/05/20 03:05 PM

    You haven't specified a capture group here.

    FailureReason=(\d+)\s+(.*?),

    In this case capture group 1 is '12514' and capture group 2 is 'EAP-TLS failed SSL/TLS handshake because of an unknown CA in the client certificates chain'.



    #QRadar
    #Support
    #SupportMigration


  • 3.  RE: Some issue in Regex Capture Group.

    Posted 03/11/24 02:47 AM

    Hi,

    I am facing the same issue, and not able to add both numbers in the same capture group.  If possible can you share the snapshots of how you are concatenating the two strings using the capture group, not the format string?

    Thanks



    ------------------------------
    Arunkumar R
    ------------------------------

    Original Message


Related Content