topic Re: regex exclude nth word in the event in Splunk Search

regex exclude nth word in the event

ppatkar — Wed, 03 Mar 2021 08:31:59 GMT

I want to ignore the actual file name in my exception events so I can group the exceptions .

For example, regex on below event should extract only "Error File not found !!!" and ignore the actual filename in between.

Error File abracadabra.gz not found !!!

Can you please advise on how to exclude this word in between the fixed format of words .

Thank you.

Re: regex exclude nth word in the event

manjunathmeti — Wed, 03 Mar 2021 08:45:32 GMT

Use rex with sed mode:

If this reply helps you, an upvote/like would be appreciated.

Re: regex exclude nth word in the event

ITWhisperer — Wed, 03 Mar 2021 09:05:41 GMT

To drop the 3rd word

| rex mode=sed "s/^(\S+\s)(\S+\s)(\S+\s)/\1\2/g"

or for more precision

| rex mode=sed "s/^(Error File )(\S+\s)(not found)/\1\3/g"

Re: regex exclude nth word in the event

ppatkar — Wed, 03 Mar 2021 09:37:56 GMT

HI @manjunathmeti @ITWhisperer , Thank you for your quick reply . I have a followup question as I intend to use capture group to gather errors . My existing search is something like below :

Can I incorporate the sed mode in this type of capture group or is there any other way ?

Thank you for all your help

Re: regex exclude nth word in the event

ITWhisperer — Wed, 03 Mar 2021 11:58:28 GMT

rex either works in capture mode or sed mode - you could use a separate rex to edit the captured field