topic Re: help with a REGEX in Splunk Search

help with a REGEX

extreme1 — Fri, 29 Mar 2013 13:48:12 GMT

I need help with a REGEX that needs to extract just fourth field in a line and nothing else.
The event looks like this:
Switch : 800471-00-04 1215G-04161 xxxxx xxxxx xxxx ........

Al I need is the "1215G-04161" portion of that line Can someone give me a quick regex for that?

Thanks!

Re: help with a REGEX

martin_mueller — Fri, 29 Mar 2013 14:01:17 GMT

Assuming each field is a block of non-spaces, and assuming each field is separated by spaces, you can do this:

^(\S+\s+){3}(?<field4>\S+)

Re: help with a REGEX

eashwar — Sat, 30 Mar 2013 18:26:18 GMT

if you want the field for all events which start with the word Switch

EXTRACT-field4= (?i)Switch\s+:\s+\S+\s+(?P<4field>\S+-\S+)

Re: help with a REGEX

extreme1 — Mon, 01 Apr 2013 16:41:39 GMT

Thanks. So what would the actual search look like?
==> index=main sourcetype="tcp-raw" | rex ????

Re: help with a REGEX

eashwar — Tue, 02 Apr 2013 07:01:01 GMT

index=main sourcetype="tcp-raw" | rex "(?i)Switch\s+:\s+\S+\s+(?P<4field>\S+-\S+)"

try this bro!!
consider voting if the answers helped you!!
thanks in advance!!
happy splunking,

Re: help with a REGEX

eashwar — Tue, 02 Apr 2013 07:01:54 GMT

instead of 4field replace your own name! which you like to give