topic Re: How to write the regex to extract semicolon delimited fields? in Splunk Search

How to write the regex to extract semicolon delimited fields?

ismarslomic — Wed, 01 Apr 2015 20:37:23 GMT

I have the following log statement, which uses semicolon delimiter and where i want to extract columns as specific fields with use of Regex in IFX.

[1427894078] SERVICE ALERT: example.com ;Current Load;CRITICAL;SOFT;3;CRITICAL - load average: 1.96, 1.29, 0.59

However, I'm not so good at Regex so would need help to create 4 separate regular expressions (will be saved as 4 different fields) which returns following results:

[1427894078] SERVICE ALERT: example.com
Current Load
CRITICAL;SOFT;3
CRITICAL - load average: 1.96, 1.29, 0.59

Re: How to write the regex to extract semicolon delimited fields?

masonmorales — Wed, 01 Apr 2015 20:51:31 GMT

Try this:

| rex "^(?<field1>[^;]+);(?<field2>[^;]+);(?<field3>w+;\w+;\d);(?<field4>.+)"

Sorry, here's a fixed version (copy/paste it to the end of your search verbatem):

| rex "^(?<field1>[^;]+);(?<field2>[^;]+);(?<field3>[^;]+;[^;]+;[^;]+);(?<field4>.+)$"

Screenshot: http://tinypic.com/r/2vj8tvd/8

Re: How to write the regex to extract semicolon delimited fields?

ismarslomic — Wed, 01 Apr 2015 21:01:07 GMT

When I copy/paste ^(?[^;]+);(?[^;]+);(?w+;\w+;\d);(?.+) in the input field "Regular expression pattern" I get error message

Invalid regex: syntax error

and

Regex does not extract any named fields.

Re: How to write the regex to extract semicolon delimited fields?

masonmorales — Wed, 01 Apr 2015 21:05:09 GMT

Did you include the quotation marks?

Re: How to write the regex to extract semicolon delimited fields?

aljohnson_splun — Wed, 01 Apr 2015 21:07:35 GMT

^(?P<alert>.*?) ;
(?P<stuff>.*?);
(?P<more_stuff>\w+;\w+;\d+);
(?P<ending_stuff>.*)$

Here is a nice tool for trying it out yourself and testing.

https://regex101.com/r/kC3gH0/1

Re: How to write the regex to extract semicolon delimited fields?

ismarslomic — Wed, 01 Apr 2015 21:09:52 GMT

No. Please see screenshot http://tinypic.com/r/35i2afs/8

Re: How to write the regex to extract semicolon delimited fields?

masonmorales — Wed, 01 Apr 2015 21:11:49 GMT

Edited original post. Retry please.

Re: How to write the regex to extract semicolon delimited fields?

ismarslomic — Wed, 01 Apr 2015 21:11:50 GMT

No, still same error message.

Re: How to write the regex to extract semicolon delimited fields?

masonmorales — Wed, 01 Apr 2015 21:13:21 GMT

Don't use the interactive field extraction. Just add-it onto your search.

Re: How to write the regex to extract semicolon delimited fields?

ismarslomic — Wed, 01 Apr 2015 21:16:02 GMT

Thanks, this works and solves my need!

Re: How to write the regex to extract semicolon delimited fields?

ismarslomic — Wed, 01 Apr 2015 21:17:23 GMT

Sorry, but it still doesnt work. However, reply from @aljohnson_splunk solved the problem. Thanks to both of you!

Re: How to write the regex to extract semicolon delimited fields?

masonmorales — Wed, 01 Apr 2015 21:18:39 GMT

Please click "Accept Answer" if this worked

Re: How to write the regex to extract semicolon delimited fields?

ismarslomic — Wed, 01 Apr 2015 21:26:03 GMT

I cant accept that comment as answer.. It seems like i need to move it to Reply, but I dont have access to do it

Re: How to write the regex to extract semicolon delimited fields?

romdece — Fri, 17 Jul 2015 14:40:01 GMT

The FIND (match) expression can be the following:

^(.*?);(.*?);(CRITICAL.*?);(CRITICAL.*)$

The REPLACE or EXTRACTION code the next one

$1\r\n$2\r\n\r\n$3\r\n$4\r\n

The \r\n standing for CR/LF.

In a PERL-transformation-routine \n would be sufficient.

More details are needed to make a real PERL-transformation-routine out of it.

You can contact me on romdeclercq at skynet dot be

Kind Regards,

Romain.