topic Re: Regex for extraction between text and second comma in Splunk Search

Regex for extraction between text and second comma

Bliide — Mon, 28 Sep 2020 17:01:35 GMT

I am working on a field extraction. I have created an extraction that pulls the field I want but I need it to pull even further. I currently have it pulling data between the text I identify and the first comma. I need it to pull from the text to the second comma. Example of a log file is this:

6/25/2014 15:05:12.724 | 18072 | EXCEPTION(V): PARN476_02HLOALP_RD:TF F RgstrData(0)(0): RegNum: 5.100.1, size of 0 bytes is invalid (-2147483638), RegisterMsg.cpp line 263 (class CRegisterFromDeviceMsg). Handled: RegisterMsg.cpp(class CRegisterFromDeviceMsg) line 269 |

My current REGEX looks like this:

(?i) regnum:(?P{FIELDNAME}[^,]+)

I need to either change the regex to get everything up to the second comma or change it to find everything between RegNum: and RegisterMsg.cpp

Please advise

Re: Regex for extraction between text and second comma

bluger_splunk — Wed, 09 Jul 2014 16:52:02 GMT

Hi Bliide --

If I understand you correctly, please correct me if I'm wrong, you would like capture the following from the above log?:

RegNum: 5.100.1, size of 0 bytes is invalid (-2147483638)

And not the entire RegNum field, correct?

RegNum: 5.100.1, size of 0 bytes is invalid (-2147483638), RegisterMsg.cpp line 263 (class CRegisterFromDeviceMsg).

For the former, you can capture it in many different ways but it would be based on the assumption that there will always be a second perior within that field. If there isn't, the regex would likely fail. If you can rely on there always being 2 periods within that field you may be able to use the following regex to capture that data.

(?<field_name>RegNum\:.*\b\,.*)(?=\,)

However, if you'd rather capture the entire field value you could use the following:

(?<=RegNum\:\s{1})(?<regnum>.*)(?=Handled\:)

Hope this helps!

Kind Regards,

~Brian

Re: Regex for extraction between text and second comma

Bliide — Wed, 09 Jul 2014 20:07:21 GMT

I am attempting to create a field extraction that will pull the data between the RegNum: and RegisterMsg.cpp

So in the example log it would pull:

5.100.1, size of 0 bytes is invalid (-2147483638)

When I try to use your suggested REGEX, splunk gives me an "Invalid regex: syntex error". I am sure it is something I am typing incorrectly. The commas are a constant in the log. That is why I was attempting to use the second comma as the end point for the extraction. Where in my field extraction do I plug in your suggested regex?

(?i) regnum:(?P{FIELDNAME}[^,]+)

Re: Regex for extraction between text and second comma

somesoni2 — Wed, 09 Jul 2014 20:32:55 GMT

Give this a try. (replaces your whole regex)

(?i) RegNum:\s(?P<FIELDNAME>.*)(,\s*\w+\.\w+) line

Re: Regex for extraction between text and second comma

Bliide — Wed, 09 Jul 2014 21:21:53 GMT

Works great. What is "line" for?

Re: Regex for extraction between text and second comma

somesoni2 — Wed, 09 Jul 2014 21:55:36 GMT

Its the literal string 'line' in your logs (from 'line 263'). If all your logs are similar, this word should remain same, hence I included it in regex.