topic Re: RegEx or Field Transformation ? in Splunk Search

RegEx or Field Transformation ?

righettod — Fri, 01 Feb 2013 11:37:11 GMT

Hello,

I have an event that have this format:

[13/01/31@00:14:05.269+0100] P-1770312 T-000001 1 AS -- (Procedure: 'put-one-message llwks.c' Line:1610) ** Attempt to write to closed stream swk-log. (1387)

I try to find (since some days ago) a RegEx expression in order to extract the value "1387" but without selecting the "()" in the target extracted value.

Is it possible to achieve this by RegEx or must I use Field Transformation ?

Thanks in advance for your helps ;o)))

Dominique

Re: RegEx or Field Transformation ?

wpreston — Fri, 01 Feb 2013 12:47:04 GMT

How about something like this? You may need to customize it further to match other samples of your data.

...your search... | rex "[(](?<MyField>\d+)[)]"

Re: RegEx or Field Transformation ?

sbrant_splunk — Fri, 01 Feb 2013 18:59:56 GMT

You actually don't need transforms, you could put the following into props.conf on the search head (remove the \ that precedes the word MyField, I had to put that in there for formatting purposes):

EXTRACT-field = (?<\MyField>\d+)\)$

This would go in the stanza for the source/sourcetype in question.