topic Re: regex help in Splunk Search

regex help

SS1 — Mon, 10 May 2021 23:08:59 GMT

Hi,

I need some help with the regex,

Currently we have below two paths, note the naming format is different for the log files

\\path\\to\\my\\app\\folder\userx-test-cpuissue.log
\\path\\to\\my\\app\\folder\usery-cpuissue.log

I wrote a regex to extract user and issue, but it is not able to pick userx since the log format is different i.e. userx-test-cpuissue.log. How do i wrote a single regex which could extract both the naming formats?

\\\\(?<source>\w+)-(?<issue>\w+)\.log$

Re: regex help

ITWhisperer — Mon, 10 May 2021 23:13:41 GMT

\\(?<source>\w+)(\-\w+)?\-(?<issue>\w+)\.log$

Re: regex help

SS1 — Mon, 10 May 2021 23:18:40 GMT

thanks for the response, although it is extracting just userx while i want it to extract userx-test. is that possible?

Re: regex help

abowesman — Mon, 10 May 2021 23:22:08 GMT

You could try this

| rex field=log "\\\\(?<user>\w+)-(?<issue>.*)\.log$"

where your 'issue' field extraction takes _any_ character up to the .log after the user rather than \w.

Shown in this example

| makeresults | eval log=split("\\\\path\\\\to\\\\my\\\\app\\\\folder\\userx-test-cpuissue.log,\\\\path\\\\to\\\\my\\\\app\\\\folder\\usery-cpuissue.log",",") | mvexpand log | rex field=log "\\\\(?<user>\w+)-(?<issue>.*)\.log$"

Hope this helps

Re: regex help

ITWhisperer — Tue, 11 May 2021 06:43:01 GMT

\\(?<source>[\w\-]+)\-(?<issue>\w+)\.log$