topic Re: Help with regex in transforms in Splunk Search

Help with regex in transforms

a212830 — Fri, 14 Jun 2019 15:58:14 GMT

Hi,

I'm hoping that someone can help me with a regex.

Here's the source data:

<OTHERFIELD>some values</OTHERFIELD><COMPID>string1 node 1</COMPID><MOREOTHERFIELDS>more values</MOREOTHERFIELDS>

I need to extract everything between the COMPID brackets. I have the following, but it's grabbing the extra bracket at the end.

REGEX = \<COMPID\>(?<dvcTEST>\w*\s)

I've tried regex101 site, but wasn't able to get it right.

Re: Help with regex in transforms

kmorris_splunk — Fri, 14 Jun 2019 16:05:35 GMT

Does this do the trick?

(?[\w\s]+)<\/COMPID>

Re: Help with regex in transforms

a212830 — Fri, 14 Jun 2019 16:37:18 GMT

This is in transforms.conf, so where would the field get defined? I tried that, it errors out when restarting the search-head:

REGEX = \<COMPID\>(?[\w\s]+)<\/COMPID>

Re: Help with regex in transforms

jnudell_2 — Wed, 30 Sep 2020 00:56:27 GMT

Hi @a212830 ,
I would do this as a one-liner in props.conf:

EXTRACT-compid = \<COMPID\>(?<dvcTEST>[^\<]+)\<\/COMPID\>

But if you REALLY want to do it in props.conf & transforms.conf:
props.conf

REPORT-extract_compid = extract_compid

transforms.conf

[extract_compid]

REGEX = &lt;COMPID&gt;(?<dvcTEST>[^&lt;]+)&lt;\/COMPID&gt;

FORMAT = dvcTEST::$1

Re: Help with regex in transforms

wneighbo — Fri, 14 Jun 2019 17:02:18 GMT

Try this:

<\COMPID>(.*?)<

*take out \ in <\COMPID>

Re: Help with regex in transforms

a212830 — Fri, 14 Jun 2019 17:06:05 GMT

Thanks. I like that better. What if I just wanted the first word between the brackets? I have similiar ones where only the first word is needed.

Re: Help with regex in transforms

jnudell_2 — Fri, 14 Jun 2019 18:38:36 GMT

Then you would use a regex match for any non-whitespace character. As an example:
Instead of [^\<]+
Use \S+

Re: Help with regex in transforms

a212830 — Fri, 14 Jun 2019 19:42:52 GMT

Tried this, but it didn't work:

EXTRACT-testcompid = \<COMPID\>(?<testdvc>\S+)\<\/COMPID\>

I'm trying to get the first word between the COMPID brackets.

Re: Help with regex in transforms

wneighbo — Fri, 14 Jun 2019 19:56:58 GMT

add .*? after your named group or remove <\/COMPID>

Re: Help with regex in transforms

a212830 — Fri, 14 Jun 2019 20:00:41 GMT

So, this? EXTRACT-testcompid = \<COMPID\>(?<testdvc>.*?)\<\/COMPID\>

I tried it in regex101, and it didn't get anything.

Re: Help with regex in transforms

a212830 — Fri, 14 Jun 2019 20:11:10 GMT

Elimnated the COMPID, and it worked. Thanks everyone! Much appreciated.

Re: Help with regex in transforms

jnudell_2 — Fri, 14 Jun 2019 20:13:44 GMT

This would work: EXTRACT-testcompid = \<COMPID\>(?<testdvc>\S+).*?\<\/COMPID\>
But using: EXTRACT-testcompid = \<COMPID\>(?<testdvc>\S+) works as well.