topic Re: props.conf | multiple EXTRACT single GROUP name in Knowledge Management

props.conf | multiple EXTRACT single GROUP name

NullZero — Thu, 05 Oct 2023 13:23:18 GMT

Hi,

I'm struggling to confirm in the docs whether this is permitted or not? I'm working on a TA for Netgear Wi-Fi, the log format is not brilliant to work with but I want to extract the ssid (Wi-Fi) network name. There are two formats of log containing this. I have written:

EXTRACT-ssid
EXTRACT-wifi_join_leave_ssid

Wi-Fi/default/props.conf EVAL-src_mac = bssid Wi-Fi/default/props.conf EXTRACT-bssid = \"bssid\"\:\"(?<bssid>\w+\-\w+\w+\-\w+\-\w+\-\w+\-\w+)" Wi-Fi/default/props.conf EXTRACT-ssid = \"ssid\"\:\"(?<ssid>.*?)" Wi-FI/default/props.conf EXTRACT-wifi_join_leave_ssid = (disconnected\sfrom\s|connected\sto\s)(?<ssid>.+?)(?: with an RSSI|}$)

Both these extractions appear to work just fine at search time which really surprised me, I was obsessing over trying to combine a long REGEX with an OR. I've obviously referred to:

https://docs.splunk.com/Documentation/Splunk/9.1.1/Admin/Propsconf

Which makes it clear that the CLASS must be unique (no problem) but the capture group name gets no mention?

Re: props.conf | multiple EXTRACT single GROUP name

richgalloway — Thu, 05 Oct 2023 13:55:42 GMT

The capture group name is indeed mentioned.

richgalloway_0-1696514122090.png

Re: props.conf | multiple EXTRACT single GROUP name

NullZero — Thu, 05 Oct 2023 14:29:47 GMT

hi @richgalloway , thanks for replying. Let me be clearer, I am extracting SSID twice using the named capture group in both instances is 'SSID' per btool.

What has surprised me and I can't see listed is the requirement for a Unique capturing group name.

Re: props.conf | multiple EXTRACT single GROUP name

richgalloway — Thu, 05 Oct 2023 15:08:50 GMT

The highlighted text in my screen shot shows where the Admin manual says a capturing group is required in EXTRACT. It does not say the group name must be unique because that is not a requirement. Although a given regex may fail if the same group name is used more than once, the same group name may be used in multiple EXTRACT settings.

Re: props.conf | multiple EXTRACT single GROUP name

NullZero — Thu, 05 Oct 2023 15:21:01 GMT

Hi @richgalloway I think this is the point. What we're saying / agreeing is that there is no requirement for a unique 'capture group name' effectively the two regex field values 'coalesce' and quite tidily in the instance that I have tested. This is a surprise and was not at all clear and actually lends flexibility.

Re: props.conf | multiple EXTRACT single GROUP name

PickleRick — Thu, 05 Oct 2023 18:13:18 GMT

Why do you escape the quotes? You don't need to do that.