topic Re: Extract string from VERTICA-MIB::vertHostName = STRING: "vertica-1" in Splunk Search

Extract string from VERTICA-MIB::vertHostName = STRING: "vertica-1"

ispdev — Mon, 11 Mar 2013 11:23:00 GMT

This is the string :
VERTICA-MIB::vertHostName = STRING: "vertica-1"

i'm trying to extract the hostname so added the following at props.conf:

EXTRACT-vertHostName = ((?(<name>)yes|VERTICA-MIB::vertHostName\s=\sSTRING:\s\")(?<vertHostName>[^"]+))

which returns:
STRING: "vertica-1"

need to return:
vertica-1

alacercogitatus — Mon, 11 Mar 2013 13:15:38 GMT

Your regex is pulling all of the string initially. You have 5 capture groups, only 2 of which are named. Try this.

EXTRACT-vertHostName = VERTICA-MIB::vertHostName\s*=\s*STRING:\s*"(?<vertHostName)[^"]*)"

ispdev — Mon, 11 Mar 2013 14:29:07 GMT

there is a ( missing here...
and > missing i think...

i also checked this
((?()yes|VERTICA-MIB::vertHostName\s=\sSTRING:\s\")([^"]+))

with a regexp tool "Regulator" and it seems to work fine there.
at splunk i just add the ? but it keeps returning:
STRING: "vertica-1"

ispdev — Wed, 13 Mar 2013 07:24:54 GMT

OK this works fine on splunk:
EXTRACT-vertHostName = .+VERTICA-MIB::vertHostName\s=\sSTRING:\s\"(?[^\"]+)