topic Re: Regex Pattern in Splunk Search

Regex Pattern

svercelli — Mon, 01 May 2017 05:42:53 GMT

I'm fairly new to Regex and having a difficult time coming up with a pattern for my query. I need to match everything after the second period in all of these values but can't figure out how

TMS_KEP.Male_RTU2.Male_PRM1_GL_OUT
TMS_KEP.Male_RTU2.Male_PRM1_PS_IN
TMS_KEP.Female_RTU2.Female_WC8_RL_OUT
TMS_KEP.Male_RTU1.Male_WC3_FS_OUT
TMS_KEP.Male_RTU1.Male_WC5_FS_OUT

There are some slight variations in this but essentially I need a pattern that takes everything after the second period.

Any help is greatly appreciated.

Re: Regex Pattern

skoelpin — Mon, 01 May 2017 05:56:04 GMT

Try this

... | rex \w+\.\w+\.(?<FIELD>\w+)

This will capture everything after the 2nd period and create a new field called FIELD

Re: Regex Pattern

svercelli — Mon, 01 May 2017 05:57:41 GMT

This worked perfectly, Thank you.

Re: Regex Pattern

gcusello — Mon, 01 May 2017 06:00:02 GMT

HI svercelli,
if your need is to take all the chars after the first dot of each row, this is your regex:

[^\.]*\.(?<All>.*)

your can test it at https://regex101.com/r/PTqtiI/1

if instead you need is to take all the chars after the second dot of each row, this is your regex:

([^\.]*\.){2}(?<All>.*)

your can test it at https://regex101.com/r/8gxaHO/1

Bye.
Giuseppe