topic Re: How do I skip words in a field extraction? in Splunk Search

How do I skip words in a field extraction?

aohls — Wed, 28 Nov 2018 18:08:14 GMT

I am working two extract fields and I have the following two lines:

"ActionName processing for AccountName completed"
"ActionName processing for account: AccountName completed"

I want to extract ActionName and AccountName as new fields using the field extractor. I am writing the expression myself and was doing something like the following:

"(?<ActionName>\w+) processing for (?<AccountName>\w+) completed"

In doing this though, I am missing the second event, "ActionName processing for account: AccountName completed". Is there a way I can have my expression run for both events correctly? I want to run with an unknown amount of space between the two and wanted to avoid doing two extractions.

I am writing the expression myself since the other way does not work correctly either.

Re: How do I skip words in a field extraction?

aholzer — Wed, 28 Nov 2018 18:20:15 GMT

This should do it:

"(?<ActionName>\w+) processing for (account:\s)?(?<AccountName>\w+) completed"

The (account:\s)? portion means that the string "account: " can appear 0 or 1 times (or in plain English, that it's optional).

Hope this helps.

Re: How do I skip words in a field extraction?

aohls — Wed, 28 Nov 2018 18:24:00 GMT

This is exactly what I was looking for. Thank you!