topic Re: Another Regex Question in Splunk Search

Another Regex Question

kwkeefer — Wed, 31 Jan 2018 01:36:33 GMT

I'm trying to rex out a new field from the message.Exception field. What I'm trying to extract is in the brackets below (the brackets are not actually in the Splunk message):

com.companyname.companyinitials.[servicename.servicenameApplication].main

I need to make it so that the regex looks for something that starts with "com.companyname.companyinitials." and ends with ".main" as the message.Exceptions field also contains something that starts with "com.companyname.companyinitials." but it is unrelated to the field I'm trying to extract.

I've tried to hack together some regex based on my google searching (I'm decent at regex for python but I can't figure out Splunk's for some reason) and I'm not doing very well. Here's what I have so far (which isn't working obviously):

...query... | rex field=message.Exception "com\.companyname\.companyinitials\.(?<Service>[^(main)]"

I'm getting a new field, but it only contains one character, and it seems to be the character for the other unrelated line that starts with the same "com.companyname.companyinitials." ...

I appreciate any help - sorry for being bad at regex..

Re: Another Regex Question

adonio — Wed, 31 Jan 2018 02:56:40 GMT

hope i understood you correctly,
give this a try:

 ... search ... | rex field="message.Exception" "com\.companyname\.companyinitials.\[(?<serviceName>\w+)\.(?<serviceNameAplication>\w+)]\.main"

extracting two fields: serviceName and serviceNameApllication
if you want one field:

 ... search ... | rex field="message.Exception" "com\.companyname\.companyinitials.\[(?<serviceName>\w+\.\w+)]\.main"

hope it helps

Re: Another Regex Question

493669 — Wed, 31 Jan 2018 03:32:11 GMT

Try this:

|rex field="message.Exception"  "com\.companyname\.companyinitials\.(?<serviceName>\w+\.\w+)\.main"

Re: Another Regex Question

mayurr98 — Wed, 31 Jan 2018 06:52:18 GMT

hey Try this run anywhere search

| makeresults 
| eval message.Exception="com.companyname.companyinitials.servicename.servicenameApplication.main" 
| rex field="message.Exception" "com\.companyname\.companyinitials\.(?<Service>.*)\.main"

In your environment, you should write

...query... | rex field=message.Exception "message.Exception" "com\.companyname\.companyinitials\.(?<Service>.*)\.main"

let me know if this helps!

Re: Another Regex Question

gokadroid — Wed, 31 Jan 2018 16:01:36 GMT

How about trying this to save the required text in field requiredText

...query... | rex field=message.Exception "com\.companyname\.companyinitials\.(?<requiredText>[\S]+)\.main"

See extraction here

Re: Another Regex Question

gokadroid — Wed, 31 Jan 2018 17:30:11 GMT

This regex has the flaw that if there are more than two elements in the requirement stated in question and I quote I need to make it so that the regex looks for something that starts with "com.companyname.companyinitials." and ends with ".main" as the message this will fail for sure.
It will fail for something like this with three elements between com.companyname.companyinitials and .main:

com.companyname.companyinitials.servicename.servicenameApplication.abc.main