topic Re: Help in Regex in Splunk Search

Help in Regex

vrmandadi — Fri, 24 Mar 2017 17:38:16 GMT

I have the field message - Method: Execute | Class: GetUsersByVinActivity
message- Method: Execute | Class: DecodeVinActivity

I want the method and class to extract as new fields from the message field

Thanks in advance

Re: Help in Regex

jrbanks6 — Fri, 24 Mar 2017 17:55:41 GMT

^\w+\s+.\s+\w+.\s+\w+\s+\w+.\s+\w+.\s+(?\w+\s+).\s+\w+.\s+(?\w+)

This is a "Greedy" RegEx - Regex101.com is your friend!

Re: Help in Regex

MuS — Fri, 24 Mar 2017 18:00:12 GMT

Hi vrmandadi,

if the events are always in the format of the example you can use this regex:

 your search here to get the events 
| rex max_match=0 field=message "Method:\s(?<Method>[^\s]+)\s\|\sClass:\s(?<Class>[^\s]+)" 
| table _time Method Class

Hope this helps ...

cheers, MuS

Re: Help in Regex

vrmandadi — Fri, 24 Mar 2017 18:19:51 GMT

Thanks a lot Mus