topic Re: Common regex in Splunk Search

Common regex

Jananee_iNautix — Mon, 28 Sep 2020 15:39:36 GMT

I have log statement as follows as

1.20131220.server-0.log:2013-12-20 09:38:00,852 [fewfg424] SUCCESS: The FTP Server [et - FTP SERVER] uploaded file [Transaction_2_113237579.csv] of length 1989 bytes from userid [EBIDWNID].
2.20131209.dbg.log:2013-12-09 17:52:12,435 [58c858c8] SUCCESS: File successfully uploaded using SFTP. Filename was [nv_afis_nav_download12092013145008.csv]. File length was [1403].
3.20131220.dbg.log:2013-12-20 09:36:35,575 [a468a] SUCCESS: File successfully uploaded using FTP. Filename [COR0083700_1.txt]. File length [5366] bytes.

I want to write a regex common to these three statements to extract the filename and file length and display in table.Can anyone say how to write a common regex to extract filename and length.

Re: Common regex

Ayn — Wed, 15 Jan 2014 13:27:50 GMT

Why would you want one common regex? It's easier to split this up into separate regexes since your messages are pretty different.

Re: Common regex

aholzer — Wed, 15 Jan 2014 14:27:01 GMT

I concur with Ayn. Just name the fields the same on the three regex's and you will still be able query across them.

Re: Common regex

richgalloway — Wed, 15 Jan 2014 14:58:41 GMT

I agree with Ayn, but perhaps something like the following will be useful.

'... | rex ".*?\[(?<filename>[\S]*?)\].*\slength[^0-9]*(?<length>[0-9]+)" | ...'

Re: Common regex

Jananee_iNautix — Thu, 16 Jan 2014 05:20:38 GMT

It is not extracting the correct filename.So i have updated my question with the complete log.Can you see to that log and suggest me the correct regex.

Re: Common regex

richgalloway — Thu, 16 Jan 2014 13:17:01 GMT

All the more reason to use separate regexes, but I think this will help you.
(?i)file.*?\[(?<filename>[\S]*?)\].*\slength[^0-9]*(?<length>[0-9]+).

BTW, I like to use http://www.regextester.com/index.html for testing regex strings.

Re: Common regex

Jananee_iNautix — Fri, 17 Jan 2014 07:00:37 GMT

Thanks its working.