topic Re: How to create a regex to extract data? in Splunk Search

How to create a regex to extract data?

donemery — Fri, 20 Jul 2018 15:02:19 GMT

I am new to Regex and hopefully someone can help me. I am trying to extract data between "[" and "SFP". It doesn't matter what the data is or length of the extract as it varies.

example 1: Jul 1 13:10:07 -07:00 HOSTNAME [MIC(0/2) link 0 SFP laser bias current high warning set ]
example 2: Jul 10 16:08:20 -04:00 HOSTNAME [sfp-1/0/2 link 2 SFP laser bias current high warning set ]

Thanks!

Re: How to create a regex to extract data?

pradeepkumarg — Fri, 20 Jul 2018 15:18:58 GMT

| rex "\[(?<my_field>.*)SFP"

Re: How to create a regex to extract data?

pruthvikrishnap — Fri, 20 Jul 2018 22:36:49 GMT

(?<=\[)(.*)(?= SFP)

Re: How to create a regex to extract data?

thambisetty — Sat, 21 Jul 2018 12:32:29 GMT

Hi @pruthvikrishnapolavarapu

your regex is correct but in Splunk syntax is different and there should be at least one name group to identify what the regex is extracting.

your regex throws below error:

Error in 'rex' command: The regex '[(.*)SFP' does not extract anything. It should specify at least one named group. Format: (?...).

Re: How to create a regex to extract data?

thambisetty — Sat, 21 Jul 2018 12:55:38 GMT

Hi @donemery

Try something like below it trims space also after 0 and before SFP. using * is not recommended:

| rex field=_raw "\[(?<my_field>[^SFP]+)\s"

The problem with * is that it will match until last occurrence of match. for example if there are two SFP(may not be in this case in general I am talking about) in log like below

Jul 1 13:10:07 -07:00 HOSTNAME [MIC(0/2) link 0 SFP laser bias current high warning set SFP

result of using * is below:

MIC(0/2) link 0 SFP laser bias current high warning set

Re: How to create a regex to extract data?

woodcock — Sat, 21 Jul 2018 17:35:12 GMT

Like this

| rex "\[(?<FieldNameHere>.*?)SFP"

Re: How to create a regex to extract data?

ddrillic — Sun, 22 Jul 2018 01:11:17 GMT

Something like .*\[(?<ext>.*)SFP.* -

Re: How to create a regex to extract data?

donemery — Mon, 23 Jul 2018 14:57:25 GMT

Thanks for your help! One more question if I may, how would I check for XFP or SFP in a message. The format would be identical, just the first letter could be "X" or "S". It will always be capitalized.

Thanks!

Re: How to create a regex to extract data?

cstump_splunk — Wed, 25 Jul 2018 20:53:32 GMT

| rex field=_raw "\[(?<my_field>.+)(SFP|XFP)"

Also, I recommend that you play around with your regexes on regex101.com