topic Re: Regex for Field Extraction in All Apps and Add-ons

Regex for Field Extraction

robhorton — Fri, 28 Jun 2013 00:42:13 GMT

I've been trying to create a regex to generate a field name without success. The data I'm attempting to parse looks like:

logsrv> Message server exiting.

I would like to make logsrv represent a subsystem so that my field is subsystem and logsrv is the data for that field.

So far I have the following expression that works on a regex tester: ^.*?(?=>)
but I'm missing something with Splunk since it won't return any results no matter I try. The field extractor doesn't have any luck either when I try to create the expression using logsrv from the results.

Please help.

Re: Regex for Field Extraction

Rob — Fri, 28 Jun 2013 00:48:20 GMT

Have you tried testing this out with the rex command in Splunk with the search language?

|rex field=_raw "^(?<subsystem>[^>]+)>"

I am not sure if that will work if your raw event has anything before the "logsrv>" in the event line such as a timestamp.

Re: Regex for Field Extraction

robhorton — Fri, 28 Jun 2013 00:57:09 GMT

Thank you! You're right. The data has the timestamp on the previous line and splunk returns results with the time and logsrv combined.

Data:
27-Jun-13 19:34:37
logsrv> Message server exiting.

Result:
27-Jun-13 19:34:37 logsrv

Do I need to search for a preceding carriage return or pattern match the time?

Thanks again!