topic regex help in Splunk Search

regex help

alanhowlett — Wed, 03 Jan 2018 15:42:34 GMT

I'm trying to configure a field extraction but am getting some strange incisions in the output. I'm running the below regex
^(?:[^:\n]*:){4}\s+(?P[^|]+), but am seeing additional values. The output should be all uppercase, but I'm still getting some lowercase values after using the [A-Z] in the regex.

I've also tried to pin point the outputs using the below but still get the additions.
^(?:[^:\n])\s state\s:\s(?P[^|]+)

What I'm trying to configure is a field extraction of an uppercase word, but I need to ignore - ()[]{}|
The output should be - ROUTE_START
But I'm also seeing things like - I'm trying to configure a field extraction but am getting some strange incisions in the output. I'm running the below regex
^(?:[^:\n]*:){4}\s+(?P[^|]+), but am seeing additional values. The oput put should be all uppercase, but I'm still getting some lowercase values after using the [A-Z] in the regex.

I've also tried to pin point the outputs using the below but still get the additions.
^(?:[^:\n])\s state\s:\s(?P[^|]+)

What I'm trying to configure is a field extraction of an uppercase word, but I need to ignore - ()[]{}|
The out put should be - ROUTER
But I'm also seeing this like - [Order{

Thanks

Re: regex help

richgalloway — Wed, 03 Jan 2018 16:36:05 GMT

Please provide some sample data that you are trying to validate with regex.

Re: regex help

alanhowlett — Tue, 29 Sep 2020 17:24:08 GMT

I can't supply the actual log as it has confidential banking information, but this is one from test.

Example of one of the messages:-

All I need to see is RECORD_KEEPING_END.

Re: regex help

somesoni2 — Wed, 03 Jan 2018 17:14:25 GMT

Does it always available as 2nd last value? If yes, give this regex a try

 state\s:\s(?P<State>[A-Z_-]+)\|[^\|]+\|$

https://regex101.com/r/24sjMS/1

Re: regex help

alanhowlett — Wed, 03 Jan 2018 18:06:52 GMT

Thanks, that worked.

I was looking for the regex site as well. Very useful.

Re: regex help

risgupta — Wed, 03 Jan 2018 18:12:05 GMT

You can use
https://regex101.com

This is very good site to learn and test your regex.

Re: regex help

risgupta — Wed, 03 Jan 2018 18:13:52 GMT

Try

state\s:\s(?P[A-Z_-]+)|[^|]+|$

and also you can use
https://regex101.com

This is very good site to learn and test your regex.

Re: regex help

gmchenry — Wed, 03 Jan 2018 20:39:21 GMT

Another version that could work is:

(?:arrived in state : )(?P\w+)