topic Re: Having issues with rex in Splunk Search

Having issues with rex

theouhuios — Tue, 11 Dec 2012 19:32:59 GMT

Hello

I am not that comfortable yet with rex commands and have been slowly learning it.I want to rex some data from this _raw and facing some issues with it.

I need the bolded datapoints from this raw.

6-Dec-12,R18541,,APPROVED,HDG,,3953,CS,Digital Support,NO,VIRTUAL REUSE,ISCW,2,WINDOWS,4,4,,5297,,,,8,8,8192,12,2012

The rex which I am using to get the first data point is

rex field=_raw "\d+-\w+-\d{2},\[A-Z]d+,,\[A-Z]*,\[A-Z]*,,\d+,\w*,(?<Function>)"

I may be completely wrong too. Can anyone please tell me where am I doing mistake here

More data

6-Dec-12,R18541,,APPROVED,HDG,,3953,CS,Digital Support,NO,VIRTUAL REUSE,ISCW,2,WINDOWS,4,4,,5297,,,,8,8,8192,12,2012

6-Dec-12,R18541,,APPROVED,HDG,,3953,CS,Digital Support,NO,VIRTUAL REUSE,ISCE,2,WINDOWS,4,4,,5297,,,,8,8,8192,12,2012

6-Dec-12,R18541,,APPROVED,HDG,,3953,CS,Digital Support,NO,VIRTUAL REUSE,ISCC,2,WINDOWS,4,4,,5297,,,,8,8,8192,12,2012

5-Dec-12,r16775,,APPROVED,HDG,,2609,st,Computing Environment,YES,VIRTUAL REUSE,ISCE,1,WINDOWS,1,2,,5252,,,,1,2,2048,12,2012

5-Dec-12,R19295,,APPROVED,TCIM,,4255,GFS,Billing & Payments Solution Center,NO,VIRTUAL REUSE,TEST CENTER,3,LINUX,2,8,,5123,,,,6,24,24576,12,2012

5-Dec-12,R16804,,APPROVED,TCIM,,3578,ST,UNIFIED COMMUNICATIONS,NO,VIRTUAL REUSE,TEST CENTER,1,LINUX,4,12,,5121,,,,4,12,12288,12,2012

5-Dec-12,C02088,,APPROVED,TCIM,,,ST,Computing Environment,NO,VIRTUAL REUSE,TEST CENTER,2,WINDOWS,1,2,,5264,,,,2,4,4096,12,2012

5-Dec-12,R19462,,APPROVED,TCIM,,4222,CCS,,NO,VIRTUAL REUSE,TEST CENTER,2,WINDOWS,2,4,,5289,,,,4,8,8192,12,2012

5-Dec-12,R19462,,APPROVED,TCIM,,4222,CCS,,NO,VIRTUAL REUSE,TEST CENTER,1,WINDOWS,4,8,,5289,,,,4,8,8192,12,2012

Re: Having issues with rex

theouhuios — Wed, 12 Dec 2012 14:26:26 GMT

Any idea on how to solve this? I am still stuck

Re: Having issues with rex

cphair — Wed, 12 Dec 2012 15:04:24 GMT

Your field name "Function" doesn't capture anything. You would need to include a [\w\s]+ inside the closing parenthesis to extract data for the field.

However, your regex probably doesn't need to be this complex. It looks like you're analyzing comma-separated data. If you always have the same number of comma-separated fields, and you always need to extract the 9th, 13th, and 15th fields, you can do something like this:



rex field=_raw "([^,]+,){8}(?[^,]+),([^,]+,){3}(?[^,]+),([^,]+,){1}(?[^,]+)"

Alternatively, you can use eval's mvfind:



... | eval allfields=split(_raw,",") | eval Function=mvfind(allfields, 8) | ...

etc. (These may not be exact, but they should get you started.)

Re: Having issues with rex

theouhuios — Wed, 12 Dec 2012 15:55:52 GMT

The rex does extract the data but the strange part is its not the correct fields. Its mixing the data from the Function field and few other fields.

Re: Having issues with rex

cphair — Wed, 12 Dec 2012 16:01:58 GMT

You have two other fields bolded; the rex is intended to extract all of them. If you only need Function you can remove the tail end of the regex. It's hard to tell what the solution is without seeing more data.

Re: Having issues with rex

theouhuios — Thu, 13 Dec 2012 15:09:12 GMT

Added some more data to my first post. What it's doing is its capturing Funtion but under function its mixing data in the 9th field with data from other fields like 11 and 12.