topic Can you help me with a regex expression(multiple in one query)? in Splunk Search

Can you help me with a regex expression(multiple in one query)?

JoshuaJohn — Tue, 02 Oct 2018 20:57:53 GMT

Trying to capture multiple groups, basically after the colon

MacAddress                : 7A:AA:82:31:24:B1
Manufacturer              : VENDOR
Username                  : SC32131BN_user
IPNET                     : 11.412.111.
PasswordExpires           : 11/24/2018 3:44:48 PM
Version                   : CCCS   - 1423209
PhysicalDriveSpace        : 19.620432424279
TotalRAM                  : 3.84324242539
DHCPLeaseExpires          : 20432424324215.000000-300
DHCPServer                : 11.12.234.61
SID                       : S-1-5-21-432233414-414324275-1810497902-1001

The name would be the field on the left.

I tried something like this: | rex "MacAddress\s+:\s(?P[^\n]) | Manufacturer\s+:\s)(?P[^\n])" but it doesn't appear to be giving me anything.

Re: Can you help me with a regex expression(multiple in one query)?

493669 — Wed, 03 Oct 2018 04:24:01 GMT

Try this :
props.conf -

[<yoursourcetypename>]
REPORT-xmlext = xml-extr

Transforms.conf -

[xml-extr]
REGEX =(\w+)\s*:\s([^\r\n]+)
FORMAT = $1::$2
MV_ADD = true
REPEAT_MATCH = true

It will extract fields at index time

Re: Can you help me with a regex expression(multiple in one query)?

JoshuaJohn — Wed, 03 Oct 2018 18:58:09 GMT

Unfortunately do not have access to edit props.conf

Re: Can you help me with a regex expression(multiple in one query)?

KailA — Wed, 03 Oct 2018 21:22:13 GMT

Hi,

If this in only one event, like a multivalue field, I may have a solution for you :

Replace every : by =
| rex field=yourfield mode=sed "s/:/=/"
Rename your field as _raw
|rename yourfield as _raw
Use KV function
| KV

Edit :

Working example :

| makeresults 
| eval data="MacAddress                : 7A:AA:82:31:24:B1,Manufacturer              : VENDOR,Username                  : SC32131BN_user,IPNET                     : 11.412.111.,PasswordExpires           : 11/24/2018 3:44:48 PM,Version                   : CCCS   - 1423209,PhysicalDriveSpace        : 19.620432424279,TotalRAM                  : 3.84324242539,DHCPLeaseExpires          : 20432424324215.000000-300,DHCPServer                : 11.12.234.61,SID                       : S-1-5-21-432233414-414324275-1810497902-1001"
| eval data = split(data,",")
| rex field=data mode=sed "s/:/=/"
| rename data as _raw
| KV

Re: Can you help me with a regex expression(multiple in one query)?

493669 — Thu, 04 Oct 2018 03:55:01 GMT

then try this in query:

...| extract kvdelim=":" pairdelim="\n"