topic Re: Can you help me write a regular expression in Splunk Search

Can you help me write a regular expression

rashi83 — Wed, 30 Sep 2020 02:47:36 GMT

Need to extract Insurer , User , Dealer name

2019-11-01 06:54:20 W3SVC4 AUSYD11AS90 172.29.5.28 GET /Areas/Framework/Content/Style/fonts/open-sans-v10-latin-regular.woff2 - 80 - 172.29.0.250 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:60.0)+Gecko/20100101+Firefox/60.0 AUTOMOTIVE_LastLoginId=MS3352919;+External_UserType=USER1;+External_ID=tEST1;+First_level_Hierarchy=TEST2;+Second_level_Hierarchy=tEST;+Account_Type=DBA;+Dealer_Outlet_Name=;+Title=;+Insurer=ABC;+encryptedcookie=470097324.20480.0000;

Re: Can you help me write a regular expression

harsmarvania57 — Fri, 01 Nov 2019 14:57:42 GMT

Can you please provide expected output for each field ?

Re: Can you help me write a regular expression

rashi83 — Fri, 01 Nov 2019 14:59:58 GMT

For example Insurer field = ABC
Account_Type = DBA

Re: Can you help me write a regular expression

rmmiller — Wed, 30 Sep 2020 02:48:27 GMT

When you say "User", do you actually mean "External_ID" or some other named field?
Technically speaking, your example contains a user field with a value of "-".

The same clarification applies for "Dealer name" -- do you actually mean "Dealer_Outlet_Name"?

Re: Can you help me write a regular expression

rashi83 — Wed, 30 Sep 2020 02:47:39 GMT

I am interested in extracting these fields -
+Insurer
+Dealer_Outlet_Name
+Account_Type

Since some times sequence of these fields can be changes, I want regular expression which contains the field name too like "hostname:(?P[^,]+)[^\n]"

How do I do for the above fields

Re: Can you help me write a regular expression

mayurr98 — Fri, 01 Nov 2019 15:24:18 GMT

Try this :

| makeresults 
| eval _raw="2019-11-01 06:54:20 W3SVC4 AUSYD11AS90 172.29.5.28 GET /Areas/Framework/Content/Style/fonts/open-sans-v10-latin-regular.woff2 - 80 - 172.29.0.250 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:60.0)+Gecko/20100101+Firefox/60.0 AUTOMOTIVE_LastLoginId=MS3352919;+External_UserType=USER1;+External_ID=tEST1;+First_level_Hierarchy=TEST2;+Second_level_Hierarchy=tEST;+Account_Type=DBA;+Dealer_Outlet_Name=;+Title=;+Insurer=ABC;+encryptedcookie=470097324.20480.0000;" 
| rex "Account_Type=(?<Account_Type>[^\(;\+)]+)" 
| rex "Insurer=(?<Insurer>[^\(;\+)]+)" 
| rex "Dealer_Outlet_Name=(?<Dealer_Outlet_Name>[^\(;\+)]+)"

in your environment you should try:

 index=<your_index>| rex "Account_Type=(?<Account_Type>[^\(;\+)]+)" 
 | rex "Insurer=(?<Insurer>[^\(;\+)]+)" 
 | rex "Dealer_Outlet_Name=(?<Dealer_Outlet_Name>[^\(;\+)]+)"

Re: Can you help me write a regular expression

to4kawa — Fri, 01 Nov 2019 15:25:37 GMT

| stats count
| eval _raw="2019-11-01 06:54:20 W3SVC4 AUSYD11AS90 172.29.5.28 GET /Areas/Framework/Content/Style/fonts/open-sans-v10-latin-regular.woff2 - 80 - 172.29.0.250 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:60.0)+Gecko/20100101+Firefox/60.0 AUTOMOTIVE_LastLoginId=MS3352919;+External_UserType=USER1;+External_ID=tEST1;+First_level_Hierarchy=TEST2;+Second_level_Hierarchy=tEST;+Account_Type=DBA;+Dealer_Outlet_Name=;+Title=;+Insurer=ABC;+encryptedcookie=470097324.20480.0000;"
| kv

Hi,
Insuer:
User:
Dealer name:
What is the value for this log?

Re: Can you help me write a regular expression

rashi83 — Fri, 01 Nov 2019 20:06:56 GMT

Thanks, it worked