Field Extraction with Inconsistent Missing Values Fields in Each of the Events

SplunkDash — Fri, 15 Oct 2021 00:41:00 GMT

Hello,

I am some issues in writing field extraction expression for following events (3 sample events are given below).

Each of the events has comma Separated 14 field values. Most of the cases event doesnot have all field values (i.e., no values between 2 commas)

I was trying with this expression ^(?P<Field1>\w+),(?P<Field2>\w+),(?P<Field3>\w+),(?P<Field4>\w+),

But it stuck at Field4 as it doesn't have any values (i.e., no values between 2 commas for Field4) in event 1. Same thing is happening for other events where there is now value between 2 commas. How would I write my field extraction expression (or (REGEX) ) to extract 14 fields from each of the events considering some fields may not have values (i.e., no values between 2 commas). Any help will be highly appreciated. Thank you so much, appreciate your support in this efforts.

23SRFBB,HESR2,000000000,,TRY5gNbkVnedIIRbrk0A3wWOtE4L,12.218.76.129,2021-10-13 06:39:48 MDT,ISDMCISA,LOGOFF,USER,,,,

34SWFBB,RESG3,000000000,10AB,TFG3nNbkVnedIIDFbrk0A3wWOtE4L,,2021-10-13 06:39:48 MDT,ISDMCISA,LOGOFF,USER,,,,

45SRFBB,SES3X,000000000,,FDTt3nNbkVnedIIBSbrk0A3wWOtE4L,12.218.76.129,2021-10-13 06:39:48 MDT,ISDMCISA,LOGOFF,USER,,,1wqa,XY355

Re: Field Extraction with Inconsistent Missing Values Fields in Each of the Events

ITWhisperer — Fri, 15 Oct 2021 04:06:05 GMT

Change the + (1 or more) to * (0 or more) for any (or all) fields which might be empty

^(?P<Field1>\w+),(?P<Field2>\w+),(?P<Field3>\w+),(?P<Field4>\w*),

topic Field Extraction with Inconsistent Missing Values Fields in Each of the Events in Installation

Field Extraction with Inconsistent Missing Values Fields in Each of the Events

Re: Field Extraction with Inconsistent Missing Values Fields in Each of the Events