topic Re: need help with regex search in Splunk Search

need help with regex search

thaghost99 — Wed, 19 May 2021 16:51:41 GMT

i would need help splitting this output into its own line.

if we can even remove the quotes, comma, curly brackets and square brackets would be icing on top. 🙂

ie:

10879053', {'duration': [57.005]

10879054', {'duration': [133.012]

10879056', {'duration': [100.212]

CustomResults="{packet_duration {['10879053', {'duration': [57.005]}, '10879054', {'duration': [133.012]}, '10879055', {'duration': [43.491]}, '10879056', {'duration': [100.212]}, '10879057', {'duration': [76.366]}, '10879214', {'duration': [44.759]}, '10879215', {'duration': [88.866]}, '10879463', {'duration': [57.006]}, '10879464', {'duration': [73.37]}, '10879466', {'duration': [94.44]}, '10907774', {'duration': [55.866]}, '10907850', {'duration': [11.561]}, '10907851', {'duration': [30.743]}, '10907852', {'duration': [104.38]}, '10908319', {'duration': [71.383]}, '10960046', {'duration': [0.16]}, '10960047', {'duration': [47.96]}, '10960097', {'duration': [107.256]}, '10960131', {'duration': [60.729]}, '10960153', {'duration': [96.39]}, '10960210', {'duration': [44.168]}, '10960211', {'duration': [43.384]}, '1108114', {'duration': [83.468]}, '1134822', {'duration': [66.569]}, '115226', {'duration': [40.005]}, '1164456', {'duration': [70.144]}, '120397', {'duration': [91.127]}, '1328915', {'duration': [41.269]}, '133417', {'duration': [72.306]}, '13537782', {'duration': [66.259]}, '13537830', {'duration': [47.595]}, '13537845', {'duration': [48.153]}, '13537846', {'duration': [48.825]}, '13537888', {'duration': [20.178]}, '13537889', {'duration': [47.347]}, '13537898', {'duration': [59.009]}, '1359649', {'duration': [76.475]}, '1412977', {'duration': [131.558]}, '14865730', {'duration': [45.554]}, '14865745', {'duration': [50.925]}, '14865746', {'duration': [41.368]}, '14865828', {'duration': [161.74]}, '14865830', {'duration': [94.507]}, '14865844', {'duration': [45.727]}, '14865845', {'duration': [95.748]}, '14865959', {'duration': [66.047]}, '14865960', {'duration': [77.699]}, '1665884', {'duration': [117.798]}, '1723748', {'duration': [111.325]}, '1760213', {'duration': [100.546]}, '1769863', {'duration': [88.724]}, '1851710', {'duration': [116.289]}, '1853478', {'duration': [6.64]}, '1853480', {'duration': [49.312]}, '1886160', {'duration': [59.463]},

Re: need help with regex search

ITWhisperer — Wed, 19 May 2021 17:15:27 GMT

| makeresults | eval _raw="CustomResults=\"{packet_duration {['10879053', {'duration': [57.005]}, '10879054', {'duration': [133.012]}, '10879055', {'duration': [43.491]}, '10879056', {'duration': [100.212]}, '10879057', {'duration': [76.366]}, '10879214', {'duration': [44.759]}, '10879215', {'duration': [88.866]}, '10879463', {'duration': [57.006]}, '10879464', {'duration': [73.37]}, '10879466', {'duration': [94.44]}, '10907774', {'duration': [55.866]}, '10907850', {'duration': [11.561]}, '10907851', {'duration': [30.743]}, '10907852', {'duration': [104.38]}, '10908319', {'duration': [71.383]}, '10960046', {'duration': [0.16]}, '10960047', {'duration': [47.96]}, '10960097', {'duration': [107.256]}, '10960131', {'duration': [60.729]}, '10960153', {'duration': [96.39]}, '10960210', {'duration': [44.168]}, '10960211', {'duration': [43.384]}, '1108114', {'duration': [83.468]}, '1134822', {'duration': [66.569]}, '115226', {'duration': [40.005]}, '1164456', {'duration': [70.144]}, '120397', {'duration': [91.127]}, '1328915', {'duration': [41.269]}, '133417', {'duration': [72.306]}, '13537782', {'duration': [66.259]}, '13537830', {'duration': [47.595]}, '13537845', {'duration': [48.153]}, '13537846', {'duration': [48.825]}, '13537888', {'duration': [20.178]}, '13537889', {'duration': [47.347]}, '13537898', {'duration': [59.009]}, '1359649', {'duration': [76.475]}, '1412977', {'duration': [131.558]}, '14865730', {'duration': [45.554]}, '14865745', {'duration': [50.925]}, '14865746', {'duration': [41.368]}, '14865828', {'duration': [161.74]}, '14865830', {'duration': [94.507]}, '14865844', {'duration': [45.727]}, '14865845', {'duration': [95.748]}, '14865959', {'duration': [66.047]}, '14865960', {'duration': [77.699]}, '1665884', {'duration': [117.798]}, '1723748', {'duration': [111.325]}, '1760213', {'duration': [100.546]}, '1769863', {'duration': [88.724]}, '1851710', {'duration': [116.289]}, '1853478', {'duration': [6.64]}, '1853480', {'duration': [49.312]}, '1886160', {'duration': [59.463]}]}}\"" | rex max_match=0 "(?<element>\d+', \{'duration': \[[\d\.]+\]\})" | fields - _raw | mvexpand element | rex field=element "(?<name>\d+)', \{'duration': \[(?<duration>[\d\.]+)\]"

Re: need help with regex search

thaghost99 — Wed, 19 May 2021 17:25:48 GMT

you are the best. 🙂 quick respond too.

spent almost 2 hours trying to figure it out.

really really appreciate it.

and it is working awesome. 🙂

hope i am not over asking. but i have another similar one that may take you minutes versus my hours.

CustomResults="{{hop1source_expected:2001:56f:fe33:f64b:d54b:83c4:3add:90b2;hop1source_actual:2001:56f:fe33:f64b:d54b:83c4:3add:90b2} True} {{hop1destination_expected:2001:568:fff2:201::9;hop1destination_actual:2001:568:fff2:201::9} True} {{hop2source_expected:2001:568:fff2:201::9;hop2source_actual:2001:568:fff2:201::9} True} {{hop2destination_expected:2001:568:fff2:201::9 2001:56f:fe33:f64b:d54b:83c4:3add:90b2;hop2destination_actual:2001:56f:fe33:f64b:d54b:83c4:3add:90b2} False} {{hop3source_expected:2001:568:fff2:201::9;hop3source_actual:2001:568:fff2:201::9} True}

would like the output to look like this.

hop1source_expected:2001:56f:fe33:f64b:d54b:83c4:3add:90b2;hop1source_actual:2001:56f:fe33:f64b:d54b:83c4:3add:90b2} True

hop1destination_expected:2001:568:fff2:201::9;hop1destination_actual:2001:568:fff2:201::9} True

etc etc.....

but if we can further break each line now to 3 columns. Expected, Actual, (True/False)

hop1source_expected:2001:56f:fe33:f64b:d54b:83c4:3add:90b2 hop1source_actual:2001:56f:fe33:f64b:d54b:83c4:3add:90b2 True

Re: need help with regex search

ITWhisperer — Wed, 19 May 2021 17:37:58 GMT

| makeresults | eval _raw="CustomResults=\"{{hop1source_expected:2001:56f:fe33:f64b:d54b:83c4:3add:90b2;hop1source_actual:2001:56f:fe33:f64b:d54b:83c4:3add:90b2} True} {{hop1destination_expected:2001:568:fff2:201::9;hop1destination_actual:2001:568:fff2:201::9} True} {{hop2source_expected:2001:568:fff2:201::9;hop2source_actual:2001:568:fff2:201::9} True} {{hop2destination_expected:2001:568:fff2:201::9 2001:56f:fe33:f64b:d54b:83c4:3add:90b2;hop2destination_actual:2001:56f:fe33:f64b:d54b:83c4:3add:90b2} False} {{hop3source_expected:2001:568:fff2:201::9;hop3source_actual:2001:568:fff2:201::9} True}\"" | rex max_match=0 "\{\{(?<element>[^;]+;[^\}]+\}\s\w+)\}" | fields - _raw | mvexpand element | rex field=element "(?<expected>[^;]+);(?<actual>[^\}]+)\}\s(?<tf>\w+)"

Re: need help with regex search

thaghost99 — Wed, 19 May 2021 17:58:54 GMT

couldnt have done this in such a quick time without you.

this works awesome. thank you very very much. 🙂