topic Re: How to extract the prefixed words from logs in Splunk Search

How to extract the prefixed words from logs

prettysunshinez — Sun, 01 Dec 2019 17:39:21 GMT

Hi All,
I require help in extracting the words that appear right before the word.
Example:
Null.set.error
Nullerror
Set-get-error
Timed out error
Unknown - error

From the above,the expected result is
Null.set
Null
Set-get
Timed out
Unknown

Kindly help me with this.

Thanks!

Re: How to extract the prefixed words from logs

MuS — Sun, 01 Dec 2019 20:32:31 GMT

Hi prettysunshinez,

Based on the provided examples, give this a try:

your search here | rex "(?<ThisIsWhatYouWant>.+?)[\s\.-]*error"

Hope this helps ...

cheers, MuS

UPDATE After some feedback and new examples the correct regex is:

 your search here | rex "(?<ThisIsWhatYouWant>[a-zA-Z]+[-\.\s]?[a-zA-Z]+)[\s\.-]*error"

Re: How to extract the prefixed words from logs

woodcock — Sun, 01 Dec 2019 22:55:37 GMT

Like this:

... | rex ":\s*(?<error_prefix>.*?)[^A-z]+\s+error"

Re: How to extract the prefixed words from logs

prettysunshinez — Thu, 05 Dec 2019 15:46:09 GMT

Hi @MuS,
Thanks for your help.
This seems to work but this seems to capture all the words that are present before the word error

For Example:
In the below log,
Could not complete.Reason : Null.set.error

The expected is only Null.set but the its extracting me 'Could not complete.Reason : Null.set'

Likewise for the others also.

Could you kindly help.

Re: How to extract the prefixed words from logs

woodcock — Thu, 05 Dec 2019 15:57:01 GMT

I updated my answer.

Re: How to extract the prefixed words from logs

prettysunshinez — Thu, 05 Dec 2019 16:25:15 GMT

Hi @Noah_Woodcock

Think you have got me wrong.
I wanted to extract only the very first word that comes before the word error.

So in my initial question,I have shared the sample as below.

Null.set.error
Nullerror
Set-get-error
Timed out error
Unknown - error

and the regex that has been suggested (rex "(?.+?)[\s.-]*error") seem to capture everything that is present before the word error.

For Example:
In the below log,
Could not complete.Reason : Null.set.error

The expected is only Null.set but the its extracting me 'Could not complete.Reason : Null.set'

Re: How to extract the prefixed words from logs

MuS — Thu, 05 Dec 2019 17:46:11 GMT

Hi prettysunshinez,

well you did not provided that example in your question so my regex was based on what you provided 😉 But try this regex :

 "(?<ThisIsWhatYouWant>[a-zA-Z]+[-\.\s]?[a-zA-Z]+)[\s\.-]*error"

this will also match correctly with the new example that you just provided 🙂

cheers, MuS

Re: How to extract the prefixed words from logs

prettysunshinez — Thu, 05 Dec 2019 18:00:23 GMT

Hi @MuS
Thanks! This works fine 🙂

Re: How to extract the prefixed words from logs

MuS — Thu, 05 Dec 2019 18:05:35 GMT

You're welcome and thank you 🙂

cheers, MuS