topic Re: search string containing alphanumeric characters and square brackets in Splunk Search

search string containing alphanumeric characters and square brackets

raghul725 — Fri, 05 Jun 2020 21:57:16 GMT

Hello,

I have the following lines in logs

[Kafka Server 4], shut down completed (kafka.server)

[Kafka Server 4], start completed (kafka.server)

The number before ] could be anything between 0-9

So I am trying the following

index=* namespace=XXXXXX | search ["Kafka Server"\s\d]\,\ss\w+

And I am expecting the result to be

[Kafka Server 4], shut
[Kafka Server 4], start

But I am not getting the desired result

While I try

index=* namespace=XXXXXX | search ["Kafka Server"
I get

[Kafka Server 4], shut down completed (kafka.server)

[Kafka Server 4], start completed (kafka.server)

[Kafka Server 5], shut down completed (kafka.server)

[Kafka Server 6], start completed (kafka.server)

...... etc

Could someone assist me please?

Regards

Re: search string containing alphanumeric characters and square brackets

richgalloway — Sat, 23 May 2020 16:24:33 GMT

The search command does not support regular expressions. The regex command and searchmatch functions (among others) do, however.

Try this.

index=* namespace=XXXXXX "[Kafka Server*" | regex "\[Kafka Server\s\d],\ss\w+"

index=* namespace=XXXXXX "[Kafka Server*" | where searchmatch("\[Kafka Server\s\d],\ss\w+")

Re: search string containing alphanumeric characters and square brackets

raghul725 — Sat, 23 May 2020 18:25:51 GMT

Nice thanks Richgalloway,
Regex works, but for some reason searchmatch does not return any results.

Anyways I can survive with Regex.

Best Regards,

Re: search string containing alphanumeric characters and square brackets

to4kawa — Sat, 23 May 2020 20:30:14 GMT

sample:

| makeresults
| eval _raw="[Kafka Server 4], shut down completed (kafka.server)
[Kafka Server 4], start completed (kafka.server)"
| multikv noheader=t
| fields _raw
| search TERM("Kafka")  TERM("Server") ((TERM("shut") TERM("down")) OR TERM("start")) TERM("completed")
| rex "(?<server>\[.*\]), (?<status>.*) completed"

Recommend:

index=* namespace=XXXXXX TERM("Kafka")  TERM("Server") ((TERM("shut") TERM("down")) OR TERM("start")) TERM("completed")
| rex "(?<server>\[.*\]), (?<status>.*) completed"
| table _time server status

you don't have to care with []

Re: search string containing alphanumeric characters and square brackets

to4kawa — Sun, 24 May 2020 01:21:37 GMT

searchmatch() matches String , not REGEX
use match()
| where match(_raw,"\[Kafka Server\s\d],\ss\w+")

Re: search string containing alphanumeric characters and square brackets

richgalloway — Sun, 24 May 2020 16:00:35 GMT

Thanks for setting me straight, @to4kawa.