topic Multicharacter Event Delimiter in Getting Data In

Multicharacter Event Delimiter

jwhughes58 — Tue, 29 Sep 2020 13:24:05 GMT

All,

I have data that looks like this

Yes, the delimiter is space, pipe, space. The problem is those rare events that have | in the url cause the original regex and delims to put information into the wrong field. I wrote this regex

^(.*)\s\|\s(.*)\s\|\s(.*)\s\|\s(.*)\s\|\s(.*)\s\|\s(.*)\s\|\s(.*)\s\|\s(.*)\s\|\s\|\s(.*)\s\|\s(.*)

and it shows things being extracted properly in the regex tool. When I put it into my laptop Splunk 6.5.2, it doesn’t process. Anyone have a solution for this problem?

TIA
Joe

Re: Multicharacter Event Delimiter

niketn — Fri, 24 Mar 2017 20:59:09 GMT

@jwhughes58...You can add the sample data to Splunk's Interactive Field Extractor and then select the unmatched event with URL having required delimiter so that Splunk re-generates the required reg-ex.

Checkout following Splunk Documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/FXSelectFieldsstep

Re: Multicharacter Event Delimiter

jwhughes58 — Fri, 24 Mar 2017 22:05:46 GMT

With kudos to @niketnilay this is the final solution to my regex question.

^(\d+/\d+/\d+\s+\d+:\d+:\d+)[^\|\n]*\|\s+([^ ]+)[^\|\n]*\|\s+(\w+)(?:[^ \n]* ){2}([^ ]+)[^\|\n]*\|\s+([^ ]+)\s+\|\s+([^ ]+)[^\|\n]*\|\s+([a-z]+_[a-z]+\d+)[^\|\n]*\|\s+([^ ]+)\s+\|\s+\|\s+(\w+)\s\|\s(.*)

It is ugly as all out, but it works.

Re: Multicharacter Event Delimiter

niketn — Sat, 25 Mar 2017 16:58:03 GMT

@jwhughes58... glad it worked 🙂