topic Re: Regex for capturing multiple values in Splunk Search

Regex for capturing multiple values

xvxt006 — Sun, 10 Nov 2013 16:09:00 GMT

Hi,

I am trying to capture all query string names (but not values as a list). I tried the below expression but i think it is capturing only the first one but not the rest. Any help is appreciated

rex field=uri "\?(?(?:([^?(?:=.*)&]+)))"

Below is an example event.

GET /Ntt-valve+Butterfly+Valves,?L1=Butterfly+Valves%25252C&L2=Stainless-Steel&Ndr=textsearchesinbase%252Btrue&operator=prodIndexRefinementSearch&originalValue=valve&sst=All

So i need
L1
L2
Ndr
operator
originalValue
sst

Re: Regex for capturing multiple values

ShaneNewman — Sun, 10 Nov 2013 16:31:32 GMT

Based on the above example:

rex field=uri "L1\=(?<L1>[\w\+\:\;\%\.]+)\&L2\=(?<L2>[\w\+\:\;\%\.]+)\&Ndr\=(?<Ndr>[\w\+\:\;\%\.]+)\&operator\=(?<operator>[\w\+\:\;\%\.]+)\&originalValue\=(?<originalValue>[\w\+\:\;\%\.]+)\&sst\=?<sst>\w+)

Re: Regex for capturing multiple values

xvxt006 — Sun, 10 Nov 2013 16:34:17 GMT

Hi the event i gave is just an example. Those parameter names would be different across different urls. So it won't work for all the urls

Re: Regex for capturing multiple values

ShaneNewman — Sun, 10 Nov 2013 16:40:14 GMT

Are all of the parameter names prefixed with a &?

Re: Regex for capturing multiple values

rsennett_splunk — Sun, 10 Nov 2013 17:01:27 GMT

props.conf



[yoursourcetype]

KV_MODE=auto

this is the default... so you really should be seeing all the fields from all the queries auto extracted.

As Shane is getting at... if you want to do it deliberately, it looks like you have a very clear delimiter pattern where KEY is prefixed with an ampersand, value is prefixed with an equals sign. The exception is the first one which you could handle separately.

There are two places you want to look to understand what we're thinking.

At the config level - take a look HERE http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Transformsconf

and search for "DELIM" and if you want to do it inline... then look at the various ways of handling DELIMs
here http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/CommonEvalFunctions