topic Multivalue Field extaction using Regular Expressions in Splunk Enterprise

Multivalue Field extaction using Regular Expressions

perrinj2 — Tue, 08 Sep 2020 02:28:50 GMT

I'm trying to extract fields from the following event data

[Scenario_summary]
Scenario Type=Manual Scenario
Goal Profile Name=Schedule 1
Mode=Scenario Scheduling
Scenario Duration=Start 27 Vusers: 1 every 00:00:15 (HH:MM:SS); Run for 00:30:00 (HH:MM:SS); Stop all Vusers simultaneously
Load Behavior=Initialize each Vuser just before it runs

[Scripts]
apache_on_5154=D:\LoadRunner Repo\LoadRunner\Loadrunner Scripts\apache_on_5154\apache_on_5154.usr
AjaxClickAndScript1=D:\LoadRunner Scripts\SPLUNK_SOLUTION_2\AjaxClickAndScript1\AjaxClickAndScript1.usr
AddNewCustomer=D:\CPE_Demo\AddNewCustomer\AddNewCustomer.usr

[Scripts_types]
apache_on_5154=Multi+QTWeb
AjaxClickAndScript1=WebAjax
AddNewCustomer=Multi+QTWeb

Specifically I want to extract the LoadRunner group names and protocols below the [Scripts_types] which can be 1 to n depending on the Scenerio. In this example the script names would be

apache_on_5154
AjaxClickAndScript1
AddNewCustomer

I've tried a regular expression with a named group to extract the fields. eg

\[Scripts_types\]\n(?<Group1>.+)=.+
\[Scripts_types\]\n(?:.+)=.+\n(?<Group2>.+)=.+\n(?:.+)=.+
\[Scripts_types\]\n(?:.+)=.+\n(?:.+)=.+\n(?<Group3>.+)=.+

But that gives me 3 different named fields and does not cater for case where there are more of less of these lines in the event.

If I use a repeating group like

\[Scripts_types\](\n(?<GroupName>.+)=.+)+

It only captures the last iteration ie "AddNewCustomer"

Anyone know how to deal with this?

Re: Multivalue Field extaction using Regular Expressions

thambisetty — Tue, 08 Sep 2020 04:02:34 GMT

is below only one event ? if yes, please don't format the event before sharing it in community especially the question is about regular expression, we can't give proper answer if the event is modified and shared here.

[Scripts_types]
apache_on_5154=Multi+QTWeb
AjaxClickAndScript1=WebAjax
AddNewCustomer=Multi+QTWeb

Re: Multivalue Field extaction using Regular Expressions

perrinj2 — Tue, 08 Sep 2020 04:04:24 GMT

It's one event

Re: Multivalue Field extaction using Regular Expressions

perrinj2 — Tue, 08 Sep 2020 04:36:01 GMT

Further to this the following regex

\[Scripts_types\](?<Scripts_types>(?:\n(?:.+)=.+)+)

will extract a single named group with value

apache_on_5154=Multi+QTWeb AjaxClickAndScript1=WebAjax AddNewCustomer=Multi+QTWeb

which I think is the only regex that makes sense in this situation.

So I'll look at how to extract the required fields from the field values. Any tips on this approach appreciated.

Re: Multivalue Field extaction using Regular Expressions

ITWhisperer — Tue, 08 Sep 2020 07:06:11 GMT

Having got a single field, can you not run a further regex on that to get just the data you require?

Re: Multivalue Field extaction using Regular Expressions

perrinj2 — Tue, 08 Sep 2020 23:26:40 GMT

@ITWhisperer Thanks, that's what I thought might be the next step. I was hoping to do it in one pass but that doesn't seem possible.