topic Help with regex needed in Splunk Search

Help with regex needed

damucka — Mon, 15 Nov 2021 13:48:45 GMT

Hello,

We have Django logs in following format:

11/15/2021 08:34:38 [INFO - 171 ] - [tenant_move.py] - [STOP_PROCESS] : STOP_PROCESS(HANA Tenant Move Alerts) completed successfully - Rows affected : 1

and we would like to extract the following fields using regex, on the above example:

TYPE=INFO

LINE=171

SCRIPT=tenant_move.py

MODULE=STOP_PROCESS

.. ideally using single regex expression and not 4 separate.

Could anyone help?

Kind regards,

Kamil

Re: Help with regex needed

gcusello — Mon, 15 Nov 2021 14:32:16 GMT

Hi @damucka,

please try this regex:

| rex "\d+\/\d+\/\d+\s+\d+:\d+:\d+\s+\[(?<TYPE>\w+)\s+-\s+(?<LINE>\d+)[^\[]+\[(?<SCRIPT>[^\]]+)[^\[]+\[(?<MODULE>[^\]]+)"

that you can test at https://regex101.com/r/cM1Jwj/1

Ciao.

Giuseppe

Re: Help with regex needed

gcusello — Mon, 15 Nov 2021 15:20:05 GMT

Hi @damucka,

good for you, see next time!
Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉