topic Re: Any regex masters out there? in Splunk Search

Any regex masters out there?

tkwaller — Wed, 08 Mar 2017 22:10:16 GMT

Working on a regex for a script log. Need to pull out user:

User accounts for \\
-------------------------------------------------------------------------------
Administrator            Guest                    SMSNomadP2P&            
The command completed with one or more errors.

Would work for the first account but wont grab the rest

-\s(?<field1>\S+)

Any ideas?
Thanks in advance!

Re: Any regex masters out there?

somesoni2 — Wed, 08 Mar 2017 22:30:05 GMT

What values you wan to capture, Administrator, Guest, SMSNomadP2P& or all?

Re: Any regex masters out there?

DalJeanis — Wed, 08 Mar 2017 22:43:04 GMT

Once you remove that hyphen off the front, that regex matches each of them, according to regex101.com. Your regex depends on there being a whitespace character immediately before the value you are trying to pull. Check to validate that there is one. Can you show us what the entire line of data looks like?

Re: Any regex masters out there?

tkwaller — Wed, 08 Mar 2017 23:03:16 GMT

yes just the user names

Re: Any regex masters out there?

tkwaller — Wed, 08 Mar 2017 23:09:29 GMT

That IS the entire log, nothing more to show. If you remove the hypen it matches much more than the account names according to regex101.com, I used the hypen to match the beginning.

Re: Any regex masters out there?

woodcock — Wed, 08 Mar 2017 23:41:59 GMT

That was pretty tough; try this:

(?ms)(?<=[\r\n]|\s{2})(?<field1>[^\r\n\s\-]+)(?=.*[\r\n])

This captures every username, regardless of how many appear, as a multi-valued field.

Re: Any regex masters out there?

DalJeanis — Thu, 09 Mar 2017 05:32:44 GMT

ah, so it's a single multi-line returned value, and you only want the line immediately after the line of hyphens. Got it.

Re: Any regex masters out there?

adauria_splunk — Thu, 09 Mar 2017 13:04:41 GMT

Awesome. Another thing to consider: If you use this in a rex command, you might need to set the max_match parameter to something other than 1.

Re: Any regex masters out there?

tkwaller — Thu, 09 Mar 2017 13:18:17 GMT

@woodcock Nice work man, I banged my head on this one for a while before posting here and quite a while after.
+1000 points for that work man, I appreciate it greatly

Re: Any regex masters out there?

tkwaller — Thu, 09 Mar 2017 15:25:16 GMT

btw threw that in a transform and added mv_add = true then updated props......good to go
Thanks again