topic Re: How to insert IF in regular expression in Splunk Search

How to insert IF in regular expression

andreac81 — Wed, 26 Apr 2017 21:03:41 GMT

Hi to all, I should extract some fields by a log file, in the log file in some cases I have a field (i.e. field1, in other cases I have another field (i.e. field2).

For example the log file can contain field1=value1 or field2=value2

I need to do something like

IF log contains filed1 
EXTRACT- field1 =.*field1=(?P<field1>\w+).*
ELSE
EXTRACT- field2 =.*field2=(?P<field2>\w+).*

Is it possible?
Thanks,
Andrea

Re: How to insert IF in regular expression

somesoni2 — Wed, 26 Apr 2017 21:38:14 GMT

The values seems to be standard key-value pair with equal sign as delimiter. Is Splunk not extracting them automatically for you (try to run the search in Smart Mode)?

Also, an event will contain either of field1 or field2, so do you want to extract them as separate field name (field1 or field2) or just a common name (say fieldname) so that you can correlate them? If you can use a common name, try like this

[yoursourcetype]
EXTRACT-fieldname = (field1|field2)=(?<fieldname>\w+)

Re: How to insert IF in regular expression

andreac81 — Thu, 27 Apr 2017 14:15:06 GMT

Using
EXTRACT-fieldname = (field1|field2)=(?\w+)
I store both field1 or field2 in fieldname, I need to store field1 in fieldname1 and field2 in fieldname2 considering that the log file can contains sometimes field1 other times field2

Thanks

Re: How to insert IF in regular expression

somesoni2 — Thu, 27 Apr 2017 14:23:13 GMT

Is Splunk not extracting them for you automatically? can we have some sample events which contains field1 and field2 ?

A simpler option would be to just setup two field extractions, one for field1 and one for field2. For events where field2 is not there, it won't extract anything anyways (null value).

[yoursourcetype]
 EXTRACT-field1= field1=(?<field1>\w+)
 EXTRACT-field2= field2=(?<field2>\w+)

Re: How to insert IF in regular expression

alemarzu — Thu, 27 Apr 2017 15:40:13 GMT

Hi there, perhaps something like this might work for you.

In props.conf add this:

[<your_sourcetype>]
TRANSFORMS-kv_xtraction = kv_extraction

In transforms.conf add this:

[kv_extraction]
REGEX = \s([^\s]+)=([^\s]+)
FORMAT = $1::$2

Hope it helps.