topic Re: Getting first match field in a event in Splunk Search

Getting first match field in a event

apand84 — Tue, 28 Nov 2017 12:03:27 GMT

In a service log different API being invoked each API start with ~( like ~getenrolled, ~enroll, ~submit) so is there any way to extract first API being called by rex

i tried (~\w+){1} but it matching with all called API .

Re: Getting first match field in a event

niketn — Tue, 28 Nov 2017 13:33:43 GMT

Based on the sample data provided please try the following rex command with max_match=1 (which is by default):

|  makeresults
|  eval _raw="~getenrolled, ~enroll, ~submit, ~somethingelse, ~somethingnew"
|  rex  "~(?<FirstAPIName>[^,]+)," max_match=1

Alternatively, you can also use caret sign ( ^ ) if you want to extract required API Name only from beginning of raw data (depends on the data, if this does not work please provide sample raw data)

|  makeresults
|  eval _raw="~getenrolled, ~enroll, ~submit, ~somethingelse, ~somethingnew"
|  rex  "^~(?<FirstAPIName>[^,]+),"

PS: First two pipes with makeresults and eval are used to generate mock data for testing regular expression.

Re: Getting first match field in a event

woodcock — Tue, 28 Nov 2017 14:17:25 GMT

Like this:

... | rex "~(?<FirstAPIName>\w+)"

Re: Getting first match field in a event

apand84 — Tue, 28 Nov 2017 17:07:42 GMT

Unfortunately it will match all called api (started with ~+API name )
I wanted to extract first matched api which is the main api call subsequent are sub api in service log .

Re: Getting first match field in a event

woodcock — Tue, 28 Nov 2017 18:40:10 GMT

Then this:

 ... | rex max_match=1 "~(?<FirstAPIName>\w+)"