topic Re: Distinguish between space and tab - REGEX in Splunk Search

Distinguish between space and tab - REGEX

emaccaferri — Thu, 18 Jul 2013 10:46:30 GMT

Hi!

I'm trying to build a regex to extract n-field in a log. Each field of the log is separated by a tab, but it's possible to find spaces (any kind of string or phrases) inside them, here an example

aaaaa, AD.cr(tab)2000-01-01 00:00:00(tab)12345/678-9(tab)987,654:321(tab)1(tab)2(tab)abcdefg123; asdoi(tab)...

There's a way to distinguish between a tab and a space or \s comprehend also tabs?
Supposing to need 6th field, this doesn't work

([a-zA-Z0-9,/:.-;=]+\s?\t){6}(?<field>[\w-:\s]+)\t

`aaaaa, AD.cr`

abcdefg123; asdoi

have to be two field.
Actually I have more than 100 field and I would like to extract 64th.

Thank you

Re: Distinguish between space and tab - REGEX

emaccaferri — Thu, 18 Jul 2013 10:50:15 GMT

Usually in the line some field are empty, this means that there are a lot of tab one after the other

Re: Distinguish between space and tab - REGEX

Ayn — Thu, 18 Jul 2013 10:55:21 GMT

\s matches whitespace, which includes both regular spaces and tabs.

Re: Distinguish between space and tab - REGEX

alacercogitatus — Thu, 18 Jul 2013 10:58:33 GMT

If you are certain there are no other tabs in the data, you can use a props/transforms to parse without regex.

props.conf [my_sourcetype] REPORT-do = extract_csv_fields_sourcetype

transforms.conf [extract_csv_fields_sourcetype] DELIMS = "\t" FIELDS = field1, field2, field3, ... field100

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf http://docs.splunk.com/Documentation/Splunk/latest/admin/transformsconf

Re: Distinguish between space and tab - REGEX

emaccaferri — Thu, 18 Jul 2013 11:02:32 GMT

Ok thanks, there is a way to match only one of the two?

Re: Distinguish between space and tab - REGEX

emaccaferri — Thu, 18 Jul 2013 11:04:16 GMT

If I use this method I have to extract all the 100 fields, even if I don't nedd them, right?
It would be not so efficient

Re: Distinguish between space and tab - REGEX

Ayn — Thu, 18 Jul 2013 11:05:45 GMT

Sure. '\t' for tab, and simply ' ' for space.

Re: Distinguish between space and tab - REGEX

alacercogitatus — Thu, 18 Jul 2013 11:07:12 GMT

You can just put the first 64 in the FIELDS section, it should still pick them up correctly. But it won't really slow it down noticeably by extracting 64 fields. I have many many more fields than that and it works great. I think it's more expensive to use a regex than the FIELDS modifier.