topic Re: Using multiple REGEX for extracting a single field in Splunk Search

Using multiple REGEX for extracting a single field

splunker12er — Sun, 21 Sep 2014 04:12:13 GMT

I want to extract fields from a customized log (no pre-defined/standard log structure)

I do need to extract a field name "Description" where it has its appropriate values at different locations in various events.
Using multilple REGEX alone I can able to locate the values.

Can i use multiple REGEX to extract a single field ?

My config files:

props.conf

[myprops]
REPORT-Description = extract_desc

transforms.conf

[extract_desc]
REGEX = (,DESC,)
REGEX = (\((\d|)\))
FORMAT = Description::$1
FORMAT = Description::$2

I am trying to achieve as above , Is this correct way ?

Re: Using multiple REGEX for extracting a single field

martin_mueller — Sun, 21 Sep 2014 13:42:59 GMT

You can use multiple regular expressions to extract one field from differently structured events... but not like that. You can for example put two EXTRACT-foo lines into your props.conf that each extract the same field name.

Do post some sample data.

Re: Using multiple REGEX for extracting a single field

landen99 — Wed, 05 Aug 2015 22:38:52 GMT

I really have no idea what your logs look like, but from your description, they may have the form:

...,DESC,(1),...

In which case the following props.conf regex will catch it if the value is always digits:

EXTRACT-foo=,DESC,\((?P<Description>\d*)

There is no need for transforms unless there are multiple values of "Description" in a single event, or you also need to extract the field value from each event because it changes.
Also, there can only be one regex per transforms entry, even though that one regex may extract multiple fields.