topic Re: Help with regex for field extraction in Splunk Search

Help with regex for field extraction

mbasharat — Fri, 22 Nov 2019 19:09:38 GMT

Hi,

I have a field value as below.
These are all fixed positions all across.

/COMPANY LOCATIONS/PA/PHILADELPHIA/ABC - PHILADELPHIA/

I need two regex:

Only State extracted from above new fields labeled as STATE
All fields extracted as LOCATION, STATE, CITY, CODE

Thanks in advance!!!

Re: Help with regex for field extraction

arjunpkishore5 — Fri, 22 Nov 2019 19:27:38 GMT

Could you please provide some more sample inputs and the expected output. For example, when you say you need LOCATION, STATE, CITY, CODE, what values should each of these hold with respect to your sample data?

Re: Help with regex for field extraction

mbasharat — Fri, 22 Nov 2019 20:03:16 GMT

After banging my head for a bit, I coded below run any where and it worked!!! 🙂

| gentimes start=-1 

| eval Location="/COMPANY LOCATIONS/PA/PHILADELPHIA/ABC - PHILADELPHIA/"

| table Location

| rex field=Location "^(?:[^\/\n]*\/){2}(?P<State>\w+)\/(?P<City>[^\/]+)\/(?P<Code>[^\/]+)"

Re: Help with regex for field extraction

mbasharat — Fri, 22 Nov 2019 20:03:58 GMT

Hi Arjun. See my own answer to my own question. Took some head bangs at this time of Friday! 🙂

Re: Help with regex for field extraction

woodcock — Fri, 22 Nov 2019 20:24:33 GMT

Like this:

| makeresults 
| eval _raw="/COMPANY LOCATIONS/PA/PHILADELPHIA/ABC - PHILADELPHIA/" 
| rex "^\/(?<WHATEVER>[^\/]+)\/(?<LOCATION>[^\/]+)\/(?<STATE>[^\/]+)\/(?<CITY>[^\/]+)\/"

I am not sure what is supposed to be CODE ... ?