topic Re: Regex after delimited field extraction in Splunk Search

Regex after delimited field extraction

tnkoehn — Fri, 14 Dec 2012 17:48:20 GMT

After a delimited field extraction in transforms.conf, I have a field called Gateway_Name that contains, for example, a value of "den01gsx01". I am trying to perform a regex on that field in props.conf to extract "den01". I was told I could to it this way but I do not even get a Site field extracted.

My props.conf looks like this:
[test]
REPORT-parsefields = test_parse
EXTRACT-site = (?<Site>^\w{5}) in Gateway_Name

My transforms.conf looks like this:
[test_parse]
DELIMS = "|"
FIELDS = "Event_Header", "Gateway_Name", "Accounting_ID", "Start_Date", "Start_Time", "Disconnect_Date", "Disconnect_Time", "Call_Duration", "Disconnect_Reason", "Service_Delivered", "Call_Direction", "Calling_Number", "Called_Number", "Billing_Number", "Route_Label"

Am I doing something wrong? Is there a better way?

Re: Regex after delimited field extraction

sowings — Fri, 14 Dec 2012 18:02:42 GMT

REPORT rules fire after EXTRACT rules; the Gateway_Name field won't exist to look for Site within it (EXTRACT-site). Consider a regular expression that's anchored on the delimiter.

You can try something like ([^|])*|){<N>} where N is the number of pipe-separated fields to skip. Looks like it should be 1.

Re: Regex after delimited field extraction

gkanapathy — Fri, 14 Dec 2012 20:43:17 GMT

REPORT runs after EXTRACT as sowings says, but you can quite simply get the effect you want by setting up your EXTRACT-site rule as a REPORT instead. REPORTS are processed in lexicographic order, so you can just do props.conf:

[test]
REPORT-parsefields = test_parse
REPORT-site = site

which will run REPORT-site/site after REPORT-parsefields/test_parse. Then in transforms.conf, you would add:

[site]
SOURCE_KEY = Gateway_Name
REGEX = (?<Site>^\w{5})

Re: Regex after delimited field extraction

tnkoehn — Fri, 14 Dec 2012 22:44:29 GMT

Ah. That's pretty cool. I will try this on Monday. Thanks!

Re: Regex after delimited field extraction

tnkoehn — Tue, 18 Dec 2012 17:16:40 GMT

Worked great! Thx!