topic Re: regex field extraction question in Splunk Search

regex field extraction question

remy06 — Mon, 28 Sep 2020 09:56:06 GMT

I'm trying to extract these values into a field called Data.

from sample 1:

CMD(XYZ) Val(*12A)

In props.conf

[log]
REPORT-mydata = mydata

In transforms.conf

[mydata]
REGEX = (?i).*CMD\((?<Data>\S+)\)

but it can only capture the values XYZ after CMD.I wana include the entire string like CMD(XYZ) Val(*12A).
How do I specify in the regex to include the entire string?

sample 1:

Sep 29 13:13:25 10.138.20.37 Sep 29 13:07:25 serverA A command (CMD) was run.|3|src=1.2.3.4 dst=0.0.0.0 msg=TYPE:JRN CLS:AUD JJOB:123 JUSER:user JNBR:123 PGM:abc OBJECT: LIBRARY: MEMBER: DETAIL:C CMD SYS CMD N SYS/CMD LIB(ABCD) DEV(*SA) SAVF(temp) OPTION(*NA) MBROPT(*ALL) OBJ(*ALL) FR(*SYSVAL) **CMD(XYZ) Val(*12A)*

Sep 29 13:13:25 10.138.20.37 Sep 29 13:07:25 serverA A command (CMD) was run.|3|src=1.2.3.4 dst=0.0.0.0 msg=TYPE:JRN CLS:AUD JJOB:123 JUSER:user JNBR:123 PGM:abc OBJECT: LIBRARY: MEMBER: DETAIL:C CMD SYS CMD N SYS/CMD LIB(ABCD) DEV(*SA) SAVF(temp) OPTION(*NA) MBROPT(*ALL) OBJ(*ALL) JJJ(*NA) **CMD(XYZ) Val(*12A)*

Re: regex field extraction question

Drainy — Fri, 30 Sep 2011 08:33:48 GMT

you could use;

(\w+\([^)]+\))

to capture each one separately and then just assign them the same field extraction name so you can associate them with your events correctly.
I have made some assumptions however that there isn't another set of characters arranged like that in the events.

Feel free to comment if this is off the mark 🙂

Have a look at the following links for details on configuring these via the config files

http://docs.splunk.com/Documentation/Splunk/4.2.3/admin/Transformsconf
http://docs.splunk.com/Documentation/Splunk/4.2.3/admin/Propsconf

Transforms.conf
[data_regex]
REGEX = (\w+\([^)]+\))
FORMAT = data::$1

Props.conf
REPORT-data_regex = data_regex

The transforms lines say to name group 1 ($1) as data (or whatever you specify).
You could also do;

Transforms.conf
[data_regex]
REGEX = (?<data>\w+\([^)]+\))

EDIT:
Assuming you answer yes to my comment on your question then;

(CMD\([^)]+\) [^)]+\))

Re: regex field extraction question

remy06 — Fri, 30 Sep 2011 08:51:11 GMT

there are set of characters in other parts of the event. I've updated the sample.Usually if I specify in transforms.conf the "" becomes the extracted field name. In your example how do I specify the field name?

Re: regex field extraction question

Drainy — Fri, 30 Sep 2011 08:54:07 GMT

@remy06 you can use the same thing, I'll update my answer with two examples

Re: regex field extraction question

Drainy — Fri, 30 Sep 2011 08:59:03 GMT

your added examples have 3 characters followed by whitespace and then more characters. my example will look for characters followed directly by an open bracket.
Is there some defined example that this data always follows you could also use to regex on?

Re: regex field extraction question

Drainy — Fri, 30 Sep 2011 09:40:32 GMT

does it always end with the data you want to collect? as in they are always at the end of the event?

Re: regex field extraction question

remy06 — Fri, 30 Sep 2011 09:41:37 GMT

thanks..I've also updated the example event hopefully its much clearer

Re: regex field extraction question

Drainy — Fri, 30 Sep 2011 09:42:04 GMT

way ahead of you, check out my comment on the question and my edit 🙂

Re: regex field extraction question

remy06 — Fri, 30 Sep 2011 09:44:46 GMT

thanks!gona test it soon

Re: regex field extraction question

remy06 — Fri, 30 Sep 2011 10:25:15 GMT

it works..thanks 🙂

Re: regex field extraction question

Drainy — Fri, 30 Sep 2011 10:25:52 GMT

no prob 🙂