topic Re: How do I capture the repeating pattern on multiple lines with REX? in Splunk Search

How do I capture the repeating pattern on multiple lines with REX?

clintla — Tue, 28 Aug 2018 14:30:10 GMT

With this dataset, the linebreaker is zone:

 zone:  zone_1wwns
        00:00:00:00:00:00:00:01

 zone:  zone_2wwns
        00:00:00:00:00:00:00:02
        00:00:00:00:00:00:00:03

 zone:  zone_3wwns  
        00:00:00:00:00:00:00:04
        00:00:00:00:00:00:00:05
            00:00:00:00:00:00:00:06

When I use the regex:

| rex max_match=0 "zone:\s+(?\w+)((\s+(?\S\S\:\S\S\:\S\S\:\S\S\:\S\S\:\S\S\:\S\S\:\S\S))+)"

It captures the last wwn, when I remove the (+) at the end, then it captures the first wwn

When I do this search w/ Notepad++ it finds all wwns (my most used tool for testing rex). Seems like this should work.
Is there another way to capture these possible extra lines?

Re: How do I capture the repeating pattern on multiple lines with REX?

richgalloway — Tue, 28 Aug 2018 14:39:38 GMT

Notepad++ is great, but I believe it does not use a Perl-compatible regex engine (PCRE) like Splunk does. Most folks here use regex101.com to test their regular expressions.

Re: How do I capture the repeating pattern on multiple lines with REX?

somesoni2 — Tue, 28 Aug 2018 15:26:14 GMT

Give this a try (runanywhere sample, everything before rex command is to generate sample data)

| gentimes start=-1 | eval raw="zone: zone_1wwns
 00:00:00:00:00:00:00:01
##zone: zone_2wwns
 00:00:00:00:00:00:00:02
 00:00:00:00:00:00:00:03
##zone: zone_3wwns
 00:00:00:00:00:00:00:04
 00:00:00:00:00:00:00:05
 00:00:00:00:00:00:00:06" | table raw | makemv raw delim="##" | mvexpand raw 
| rex field=raw max_match=0 "zone:\s+(?<zone>\w+)[\r\n\s](?<ZoneVal>\s*((\d{2}\:)+\d+[\r\n\s]*)+)"

Re: How do I capture the repeating pattern on multiple lines with REX?

clintla — Tue, 28 Aug 2018 17:05:37 GMT

"This is close.. although it takes all the ZoneVal & lops them into the same field value. I need them to be different values.

after rethinking it, broke into 2 rex's.

| rex "zone:\s+(?\S+)"
| rex max_match=0 "(?\S\S:\S\S:\S\S:\S\S:\S\S:\S\S:\S\S:\S\S)"

That nailed it... although dang it! my first attempt should have worked! 🙂 "