topic Re: regular expression in Splunk Search

regular expression

sphiwee — Tue, 13 Oct 2020 16:25:19 GMT

Can i get a regular expression to show TSK KUBHEKA v2.0.70 from the below extract

2020-10-13 17:24:15 [bp-[xxxxxxxxx]-completeMachineRun-2053693] HitService [INFO] Created typed run Run: id=2053695, xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx name=AO TSK KUBHEKA v2.0.70 (verificationservice_VerificationFinalization) {size:0, status:READY_TO_PROCESS, rootRun:2c863fbe-7896-4e98-8f7f-7c79f930ab86, data:}

Re: regular expression

gcusello — Tue, 13 Oct 2020 16:29:03 GMT

Hi @sphiwee,

check if a regex like this can solve your problem:

| regex "name\=\w+\s+(?<my_field>.*)\s+v\d+\.\d+\.\d+"

that you can test at https://regex101.com/r/0eFSVC/1

Ciao.

Giuseppe

Re: regular expression

inventsekar — Tue, 13 Oct 2020 16:50:45 GMT

| makeresults |eval log="2020-10-13 17:24:15 [bp-[xxxxxxxxx]-completeMachineRun-2053693] HitService [INFO] Created typed run Run: id=2053695, xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx name=AO TSK KUBHEKA v2.0.70 (verificationservice_VerificationFinalization) {size:0, status:READY_TO_PROCESS, rootRun:2c863fbe-7896-4e98-8f7f-7c79f930ab86, data:}" | rex field=log "name\=\w+\s+(?<name_field>.*)\(" | table name_field

Re: regular expression

sphiwee — Tue, 13 Oct 2020 17:53:06 GMT

im sorry please include

(verificationservice_VerificationFinalization)

Re: regular expression

inventsekar — Wed, 14 Oct 2020 01:23:38 GMT

Please update that rex last part of the rex - "\(" replace with "\{".

EDIT - added the image and edited the code