topic Re: Regex lookahead issue in Splunk Search

How to use regex lookahead to capture the information from the 4th stanza of my log?

mikecal — Fri, 06 Jan 2023 04:15:01 GMT

I'm trying to use the following search to capture information regarding an identification code:

index=calabrio MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS | rex field=_raw "Filename(?<phoneid>)(?=[A-Z][A-Z][A-Z]).*(?=-)" | stats count by phoneid

Here an example of the log entry:

2023-01-04 15:08:09.001175 DEBUG [0xce4] VoiceRecorderUpdateTask.cpp[28] VoiceRecorderUpdateTask::runTask: MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS : Filename(4281-1672873674000-4125-SEP12345678-98962688)

I want to capture the information from the 4th stanza. I'm trying to use lookahead to target the three alpha characters. This works as expected in regex101.com but Splunk is not producing any results. I've read in several articles that lookahead doesn't work as you would expect it to but I haven't been able to piece together a search that will work. Maybe I'm going about this the wrong way. Any help is appreciated.

Thanks,

Mike

Re: Regex lookahead issue

richgalloway — Thu, 05 Jan 2023 01:25:51 GMT

As you've read, Splunk does not do well with lookahead (or lookbehind). Fortunately, lookahead rarely is necessary. Try this regex to get the three letters in the Filename field.

Filename\([\d-]+(?<phoneid>[A-Z]{3})

Re: Regex lookahead issue

gcusello — Thu, 05 Jan 2023 08:36:35 GMT

Hi @mikecal,

i you want to extract the full phoneid, you can use :

index=calabrio MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS | rex "Filename\((?<phoneid>[^\)]+)" | stats count by phoneid

that you can test at https://regex101.com/r/o6MmDk/1

if you want only the last numbers, you can use

index=calabrio MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS | rex "Filename\(\w+-\w+-\w+-\w+-(?<IBAN>[^\)]+)" | stats count by phoneid

that you can test at https://regex101.com/r/o6MmDk/2

Ciao.

Giuseppe

Re: Regex lookahead issue

mikecal — Thu, 05 Jan 2023 18:30:22 GMT

Thanks @richgalloway and @gcusello for your quick replies! Ultimately, Rich's search served my needs best. One funny oddity, I needed to use the dash after the stanza as a delimiter and lookahead worked just fine in that capacity.

index=calabrio MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS
| rex field=_raw "Filename\([\d-]+(?<phoneid>[A-Z]{3}.*(?=-))"
| stats count by phoneid