topic How to manage multiple regex using same field name in Splunk Search

How to manage multiple regex using same field name

att35 — Wed, 31 Jan 2024 14:33:56 GMT

We have application data coming from Apache Tomcat's and have a regex in place to extract exception name. But there are some tomcats sending data in a slightly different formats and the extraction doesn't work for them.

I have updated regex ready for these different formats, but want to keep the field name same, i.e. exception.

How Do I manage multiple extractions against the same sourcetype while keeping the field names same? If I add these regex in transforms, would they end up conflicting with each other?

Or should I be creating them into different fields, such as exception1, exception2 and then use coalesce to eventually merge them into a single field?

Re: How to manage multiple regex using same field name

gcusello — Wed, 31 Jan 2024 14:35:25 GMT

Hi @att35,

I usually use the different names and coalesce solution in a calculated field.

Ciao.

Giuseppe

Re: How to manage multiple regex using same field name

ITWhisperer — Wed, 31 Jan 2024 15:25:35 GMT

If you can establish sufficiently unique anchors in your regex, you might be able to use pipe-delimited options e.g.

(anchor 1|anchor 2|anchor 3)(?<field>field pattern)

Re: How to manage multiple regex using same field name

gcusello — Wed, 21 Feb 2024 05:45:14 GMT

Hi @att35 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉