topic Re: why does the regex not work? in Splunk Search

why does the regex not work?

kennmunklarsen — Fri, 12 Oct 2012 07:48:56 GMT

Why does the following regex not both records:

(?i)(?:MEthod: ) | (?:Metode: )(?P<FIELDNAME>\w+)

Records:

2012-10-12 09:27:53,903 Ch pw succeded  Brand: /vvv_erhverv Metode: EMPLOYEE LDAP 
2012-10-12 09:25:44,374 Login succeded  Brand: /ppp_medlem MEthod: SPECIAL  LDAP

I would like to match SPECIAL and EMPLOYEE

Re: why does the regex not work?

MHibbin — Fri, 12 Oct 2012 07:58:13 GMT

How about doing something like:

(?i)brand\:[^\:]+\:\s+(?P<fieldname>[^ ]+)

EDIT: Missed "+"

You can test regex out on the following site http://gskinner.com/RegExr/, (believe @Drainy shared this with me, to pass on some credit 🙂 ) it generally works for most regex you will need.

EDIT: And using your syntax, I believe the following should work

(?i)((?:MEthod:\s+)|(?:Metode:\s+))(?P<FIELDNAME>\w+)

You had a space between the pipe character.

Re: why does the regex not work?

MuS — Fri, 12 Oct 2012 08:16:43 GMT

I fiddled out this one:

(?i)((?<=MEthod: )|(?<=Metode: ))(?<FIELDNAME>\w+)

this will match only EMPLOYEE and SPECIAL

Re: why does the regex not work?

kennmunklarsen — Fri, 12 Oct 2012 09:22:02 GMT

MuS
Splunk gives the error:
Invalid regex: syntax error

when i use this:
(?i)((?<=MEthod: )|(?<=Metode: ))(?\w+)

Re: why does the regex not work?

MuS — Fri, 12 Oct 2012 09:30:46 GMT

what happens if your run this:

| regex _raw="(?i)((?<=MEthod: )|(?<=Metode: ))(?\w+)"

Re: why does the regex not work?

Drainy — Fri, 12 Oct 2012 09:46:54 GMT

Blimey, why not just do;

(?i)(?:method|metode)\:\s(\w+)

🙂