topic Re: Can regex remove spaces inside a capture group? in Splunk Search

Can regex remove spaces inside a capture group?

donemery — Mon, 15 Apr 2019 17:03:35 GMT

I am using regex slot and port information. Here is an example of the syslog output:

Slot1 : OLTPort2

Is it possible in regex to remove the spaces around the :?

I would like it to look like this:

Slot1:OLTPort2

By using two captures I can use eval to combine two extracts but I would prefer to do it with regex, if possible.

| where isnotnull(S_Slot) AND isnotnull(S_Port) | eval SlotAndPort = S_Slot . ":" . S_Port

Re: Can regex remove spaces inside a capture group?

grittonc — Mon, 15 Apr 2019 17:09:59 GMT

You need rex command in sed mode. Assuming your field with both slot and port is SlotAndPort:

... your search ...
| rex field=SlotAndPort mode=sed "s/ //g"

https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Rex has more details.

Re: Can regex remove spaces inside a capture group?

niketn — Mon, 15 Apr 2019 17:16:05 GMT

@donemery you can use replace() evaluation function to remove spaces from your data.

| makeresults
| eval data="Slot1 : OLTPort2"
| eval dataWithoutSpace=replace(data,"\s","")

Re: Can regex remove spaces inside a capture group?

woodcock — Mon, 15 Apr 2019 17:17:57 GMT

Assuming that your existing RegEx looks something like this:

(?<Slot1>[^xyz]+)

Change it to this:

\s*(<Slot1>[^xyz\s]+)\s*

Re: Can regex remove spaces inside a capture group?

grittonc — Mon, 15 Apr 2019 17:24:40 GMT

haha, I was overthinking. @niketnilay's answer is much better! This would be more useful if you needed to replace a pattern, not a particular character.

Re: Can regex remove spaces inside a capture group?

donemery — Mon, 15 Apr 2019 17:34:10 GMT

I can't get the \s* to work with my field extraction. Maybe I am doing something wrong.

Here is the full field extraction:

^[^\[\n]*\[\s+(?P[S,s]lot\d+\s+\:\s+[O,U][L,p][T,l]\D{3,8}\d+)

Here is an example of the data I am extracting from:

Apr 15 17:25:49 +00:00 HOST06-XXXX [ Slot4 : OLTPort3 : ONU7 : In service.]

Re: Can regex remove spaces inside a capture group?

woodcock — Mon, 15 Apr 2019 18:05:46 GMT

Always share as much as you can. Now that we have your RegEx, your problem is clear. You cannot fix it in a single step; it till take 2 and the 2 change depending on whether this is search-time or index-time, which again, you neglected to tell us. In either case, add a new transform to the end of the existing REPORT- or TRANSFORMS- line called StripSpaces. Then put this in your transforms.conf:

[StripSpaces]
SOURCE_KEY = <YourExistingFieldNameWhichYouDidNotShare>
REGEX = (\S+)\s*:\s*(\S+)
FORMAT = $1::":"::$2

Re: Can regex remove spaces inside a capture group?

donemery — Mon, 15 Apr 2019 18:20:04 GMT

Thanks. In the future I will provide more details to start and I will reach out to the folks that administer Splunk for us to see what is the method they will implement.