topic Re: Combining 2 RE into single RE in Splunk Search

Combining 2 RE into single RE

muralisushma7 — Wed, 08 Feb 2017 09:22:24 GMT

Hi,

For every event in the SPLUNK, I have set the RE for host field. In general all the input to Splunk is of the form: rdnglagos010-1-1.Fa0-1.ncr.com, hence I set the RE as (?\w+-\d+-\d.+) while indexing the data. Now, apart from this, I also have input of the form: fusxpowtc1.eth-s4p1, hence I set the RE as (?\w+..+). When I combine them as (?\w+-\d+-\d.+)| (?\w+..+), I get the correct output for fuspowtc1.eth-s4p1 but for other one it displays as 1.ncr.com.

Can someone help me in writing a single RE such that host field should display correct output.

Let me know if you need any more information.

Regards,
Sushma.

Re: Combining 2 RE into single RE

richgalloway — Wed, 08 Feb 2017 13:25:42 GMT

This works for me in regex101.com

(?<h1>\w+-\d+-\d.+)|(?<h2>\w+\..+)

Re: Combining 2 RE into single RE

muralisushma7 — Thu, 09 Feb 2017 07:42:09 GMT

Hi,

Still it is not working for me. I executed the RE that you gave.

It displays the output as rdnglagos010-1-1.Fa0-1.ncr.com in the host field which is correct but for the other one it displays the VM name in the host field rather than fusxpowtc1.eth-s4p1.

What can I do?

Regards,
Sushma.

Re: Combining 2 RE into single RE

richgalloway — Thu, 09 Feb 2017 13:51:39 GMT

Try this run-anywhere search. Field h2 should match the second host name. If it does not then there is something wrong in your search.

| makeresults 2 | eval host="fusxpowtc1.eth-s4p1" | rex field=host "(?<h1>\w+-\d+-\d.+)|(?<h2>\w+\..+)" | table host h1 h2

Re: Combining 2 RE into single RE

somesoni2 — Thu, 09 Feb 2017 14:59:17 GMT

You're trying to extract these fields from raw data or any other field? Can we have some sample entries? DIfferent regex is required for both the cases.

Re: Combining 2 RE into single RE

muralisushma7 — Fri, 10 Feb 2017 07:34:55 GMT

Hi,

Ran the above search and fusxpowtc1.eth-s4p1 displayed under host field where as the fileds h1 and h2 are empty.

Regards,
Sushma.

Re: Combining 2 RE into single RE

muralisushma7 — Fri, 10 Feb 2017 07:36:52 GMT

Hi somesoni2,

I am trying to extract these fields from raw data itself.

Regards,
Sushma.

Re: Combining 2 RE into single RE

somesoni2 — Fri, 10 Feb 2017 15:37:13 GMT

You would need to setup a boundary of some sort so that combined regex works. Can you post a sample event for each type of host format? Scrub any sensitive data before posting.

Re: Combining 2 RE into single RE

richgalloway — Fri, 10 Feb 2017 15:37:44 GMT

What version of Splunk are you using? Please copy-and-paste your search as code so we can see it.

Re: Combining 2 RE into single RE

DalJeanis — Fri, 10 Feb 2017 18:23:27 GMT

We really need a more complete example of the _raw to help you work this out.