topic How to copy/paste a regex into splunk in Splunk Search

How to copy/paste a regex into splunk

mikefoti — Mon, 02 Apr 2012 20:38:06 GMT

My ultimate goal is to create a regex expression that can be used use to extract fields from any record made up comma-seperated fields. For example, if a normal event looks like this:

"RADSP01HDQRW","IAS",04/02/2012,16:14:38,2,,"RETAIL\HH01-9002",,,,,,,,0,"10.170.191.48"

it will always contain 15 commas, therefore 16 fields.

I created the regex expression below and tested it with UltraEditPro.

[^,](?=(,[^,]){15,15}$)

It will find the 1st field. In order to make it find the 2nd field I simply replace (15,15) with (14,14).

Everything looked great in UltraEdit but when I pasted it into the Field Extraction UI
it complained...

Invalid regex: no named extraction at position 7 (i.e., "=(,[^,]*){..."). Expected "(?Ppattern)"

I tried various combinations before thinking surely someone else has already tackled this problem... so here's hoping!

Re: How to copy/paste a regex into splunk

tgow — Mon, 02 Apr 2012 20:57:02 GMT

Since you have a delimiter that is separating your fields then I would take a look at the following:

$SPLUNK_HOME/etc/system/local/props.conf

[data]
REPORT-fieldextract = fieldextract

$SPLUNK_HOME/etc/system/local/transforms.conf

[fieldextract]
DELIMS = ","
FIELDS = field1,field2,field3,...field16

Remember that this field extraction happens at index time so this will only work for the latest data.

Here is a link to more information:

http://docs.splunk.com/Documentation/Splunk/4.3.1/Admin/Transformsconf

Re: How to copy/paste a regex into splunk

mikefoti — Mon, 28 Sep 2020 11:38:07 GMT

Thanks for the reply. I read the props and transforms documentation and am unclear if the edits need to be in these files on the indexer or the UF.

Also, if I want to extract the csv fields only for sourcetype=foo, does this look right?

Props.conf [sourcetype::foo]
report_radius=extract_radius_CSV

Transforms.conf: [extract_radius_CSV]
DELIMS=”,”
FIELDS=”nps_svrName”,”nps_svcName”,”nps_Date”,”nps_Time”,”nps_packetType,”nps_userName”,”nps_userFQDN”,”nps_calledStation”,”nps_callingStation”

Re: How to copy/paste a regex into splunk

MarioM — Fri, 06 Apr 2012 05:32:22 GMT

Fields extractions are on the search head then if your indexer is the search head too then you should put it there.
Your sencond extraction via delims looks right.