topic Re: Regex sanity check - fixed record length field extraction in Splunk Search

Regex sanity check - fixed record length field extraction

himynamesdave — Tue, 02 Jun 2015 19:20:21 GMT

Guys, I have a horrible dataset in Splunk and am trying to match fields based on a position in event.

As an example, I need to extract a field which is found in the 201st and 202nd position of the event. I tried the following extraction (with some iteration) which fails.

| rex (.){200}(?P<FIELD>.{2})

What should it look like?

Thanks!

Re: Regex sanity check - fixed record length field extraction

richgalloway — Tue, 02 Jun 2015 19:26:43 GMT

Remove the parentheses from around the first dot and it should work. Of course, the whole regex string must be quoted.

 | rex ".{200}(?P<FIELD>.{2})" | ...

Re: Regex sanity check - fixed record length field extraction

jacobwilkins — Tue, 02 Jun 2015 21:48:06 GMT

Also, anchor it.

| rex "^.{200}(?P<FIELD>.{2})"

Re: Regex sanity check - fixed record length field extraction

himynamesdave — Wed, 03 Jun 2015 11:22:39 GMT

Thanks guys!