topic Re: Generated pattern (regex) in Splunk Search

Generated pattern (regex)

kailun92 — Thu, 20 Jun 2013 08:21:38 GMT

I need to extract both of the words, is there anyone that knows how ? I have used this
(?i)summary : (?P<FIELDNAME>[\w\.]+)
but it extracts only the word Mostly.

summary : Mostly Cloudy

Re: Generated pattern (regex)

peter_krammer — Thu, 20 Jun 2013 08:39:24 GMT

(?<field_name>\S+)\s+:\s+(?<field_value>.+)

Be careful about the cases of 's', because '\s' has a different meaning than '\S'.

Re: Generated pattern (regex)

peter_krammer — Thu, 20 Jun 2013 09:06:33 GMT

The questionmark in the inner caption group was producing a problem, I edited my answer to my tested solution.

Re: Generated pattern (regex)

kailun92 — Thu, 20 Jun 2013 09:07:25 GMT

Invalid regex: no named extraction at position 27 (i.e., ">([\w.]+..."). Expected "(?Ppattern)"

Re: Generated pattern (regex)

peter_krammer — Thu, 20 Jun 2013 09:29:37 GMT

Now I changed it, so the inner caption group is named as well, even if it is not needed on my test instance (5.0.1).

kailun, which splunk version do you use?

Re: Generated pattern (regex)

kailun92 — Thu, 20 Jun 2013 09:49:49 GMT

I am using 5.0.2. Btw it worked but my data is inputed this way(below), it extracts this

FIELDNAME
Mostly Cloudy
temperature
Foggy
temperature
lastword
temperature

(Splunk reads my data every 5 minutes)
time : 1371715104
visibility : 0.67
windBearing : 260
windSpeed : 9.41
psiAverage : 182
cloudCover : 0.61
dewPoint : 65.58
humidity : 0.39
icon : fog
ozone : 267.04
precipIntensity : 0
pressure : 1005.64
summary : Foggy
temperature : 94.49

Re: Generated pattern (regex)

peter_krammer — Mon, 28 Sep 2020 14:08:20 GMT

Well thats quite a different usecase, thanI would have guessed from your initial question. I updated my answer to extract the field_name ("summary") and the field_value ("Mostly Cloudy") seperatly.

But maybe you also want to take a look at handling multiline events.

Re: Generated pattern (regex)

kailun92 — Thu, 20 Jun 2013 10:26:29 GMT

see my comments down, I cannot post codes in here.

Re: Generated pattern (regex)

kailun92 — Sat, 22 Jun 2013 07:00:29 GMT

I tried this expression and it work. Btw thanks for your help ! 😃

(?i)Summary : (?P.+)\n