topic Re: RegEx for variable message field extraction in Splunk Search

RegEx for variable message field extraction

johnebgood — Mon, 28 Sep 2020 12:42:06 GMT

Hello, I have logs coming in that look like the following:

(Tab between columns)

server1.something.com ApacheLog 0 10.0.0.1

server2.something.com ApacheLog 0 10.0.0.2

server3.something.com GenericLog 0 0 0 0

server4.something.com GenericLog 0 0 0 0

Using the IPs to have splunk generate a pattern results in this regex:

(?i)^(?:[^\t]*\t){3}(?P<FIELDNAME>[^ ]+)

The IP will be in the same place every time ApacheLog is present... so basically I want my RegEx to be something like the following which doesn't work:

^*\t*ApacheLog*\t*\t(?P<FIELDNAME>[^ ]+)

Any assistance would be appreciated.

Thanks,
John

Re: RegEx for variable message field extraction

Rob — Fri, 26 Oct 2012 18:31:35 GMT

Hi John,

Try the following regex:

\s+ApacheLog\s+\d\s+(?<MyFieldName>(?:\d{1,3}\.){3}\d{1,3})

You can test that by using the rex command on your events and seeing if the field contains what you expect. For example:

|rex field=_raw "\s+ApacheLog\s+\d\s+(?<MyFieldName>(?:\d{1,3}\.){3}\d{1,3})"

Re: RegEx for variable message field extraction

johnebgood — Fri, 26 Oct 2012 18:56:05 GMT

This works in the search field however when I attempt to edit the pattern in "Extract Fields" I get a "Invalid regex: syntax error". Any thoughts there?

Thanks!

Re: RegEx for variable message field extraction

Rob — Fri, 26 Oct 2012 19:19:37 GMT

Using the interactive field extractor, the syntax its looking for will be slightly different. Try the following there:

.*\s+ApacheLog\s+\d\s+(?P<MyFieldName>(?:\d{1,3}\.){3}\d{1,3})

Re: RegEx for variable message field extraction

johnebgood — Fri, 26 Oct 2012 20:38:56 GMT

Perfect, thanks!