topic Re: Formatting Log Name with Regex in Splunk Search

Formatting Log Name with Regex

JibBgh — Tue, 29 Sep 2020 10:30:40 GMT

Hello. I am currently trying to do something with a list of logs that I have been given.

All of the logs have the same format:

/this/is/.../an_example_relevantInformationHere.2016-08-03.log

What I want to do is to use regex to search through the strings and to find the part that says relevantInformationHere and create a table with that as the header. Right now my rex looks like:

..|rex "an_example_(?\w+)."| table parameterName

It looks like it worked in the regex testers that I used, but I am not receiving the expected output in splunk. What am I doing wrong and is there a difference between the splunk regex and the regex on another site?

Thank you.

Re: Formatting Log Name with Regex

sundareshr — Wed, 03 Aug 2016 14:46:13 GMT

Try this

... | rex field=_raw "_\w+_(?<parameterName>\w+)\." | table parameterName

Re: Formatting Log Name with Regex

JibBgh — Wed, 03 Aug 2016 14:58:46 GMT

When I tried that, it ended up putting the raw string parameterName instead of the actual value it should be.

Re: Formatting Log Name with Regex

sundareshr — Wed, 03 Aug 2016 15:42:44 GMT

I just test this run anywhere sample and it works. Can you test this and let me know the results

| makeresults | eval x="/this/is/.../an_example_relevantInformationHere.2016-08-03.log" | rex field=x "_\w+_(?<parameterName>\w+)\." | table parameterName

Re: Formatting Log Name with Regex

javiergn — Wed, 03 Aug 2016 15:46:37 GMT

Assuming you are talking about the source field give this a go:

| rex field=source "(?<parameterName>[a-zA-Z]+)\.\d{4}-\d{2}-\d{2}\.\w+"

Keep in mind you can play with the following bit [a-zA-Z]+ to accept whatever symbols you might expect in your relevant information section. Also remember \w+ includes underscores.

Hope that helps

Re: Formatting Log Name with Regex

JibBgh — Wed, 03 Aug 2016 18:30:08 GMT

That worked properly, however, will this work properly without hard coding the name?

Re: Formatting Log Name with Regex

sundareshr — Wed, 03 Aug 2016 18:38:22 GMT

Is the name of the file. As in the source? If it is, change the rex command to this and it should work

rex field=source "_\w+_(?<parameterName>\w+)\."