topic Re: Regex SOS! in Splunk Search

Regex SOS!

sdorich — Mon, 28 Sep 2020 15:49:48 GMT

I'm trying to match everything in quotes in the following log file example. I've been working on this for a while and am desperate!

This regex matches the first item in quotes in a given event (but I want to match everything).

((?:[^ \n]* ){1,8}'(?P<sis_audit_type>[^']+))

I would have thought that this regex works but it gives an error:

([^]+:[^]+:\s[^]+'(?P<sis_audit_type>[^]+)'){1,5}

My example log file is attached and pasted below. Thanks!

2014-02-03 05:26:53 - User: SiteScope Administrator. Operation performed: logged in.
2014-02-03 10:19:20 - User: SiteScope Administrator. Operation performed: Username and password do not match. Failed to login.
2014-02-03 10:19:24 - User: SiteScope Administrator. Operation performed: logged in.
2014-02-03 11:44:33 - User: SiteScope Administrator. Operation performed: logged in.
2014-02-03 11:53:54 - User: SiteScope Administrator. Operation performed: logged in.
2014-02-03 12:10:17 - User: SiteScope Administrator. Operation performed: Alert 'sound' created in 'SiteScope\Test\google.com'.
2014-02-03 12:10:43 - User: SiteScope Administrator. Operation performed: UPDATE Monitor 'SiteScope\Test\google.com' start:
2014-02-03 12:10:43 - User: SiteScope Administrator. Operation performed: Monitor 'SiteScope\Test\google.com' update: '_classifier2' updated from '' to 'percentGood != 0 error every day, all day'.
2014-02-03 12:10:43 - User: SiteScope Administrator. Operation performed: Monitor 'SiteScope\Test\google.com' update: '_classifier1' updated from 'percentGood == 0 error every day, all day' to ''.
2014-02-03 12:10:43 - User: SiteScope Administrator. Operation performed: UPDATE Monitor 'SiteScope\Test\google.com' end.
2014-02-03 12:10:43 - User: SiteScope Administrator. Operation performed: MANUAL RUN for monitor 'SiteScope\Test\google.com'.
2014-02-03 12:20:18 - User: SiteScope Administrator. Operation performed: MODIFY Acknowledgment on 'SiteScope\Test\google.com' start:
2014-02-03 12:20:18 - User: SiteScope Administrator. Operation performed: Acknowledgment 'ack google' was added to 'SiteScope\Test\google.com'
2014-02-03 12:20:18 - User: SiteScope Administrator. Operation performed: UPDATE Monitor 'SiteScope\Test\google.com' start:
2014-02-03 12:20:18 - User: SiteScope Administrator. Operation performed: UPDATE Monitor 'SiteScope\Test\google.com' end.
2014-02-03 12:20:18 - User: SiteScope Administrator. Operation performed: MODIFY Acknowledgment on 'SiteScope\Test\google.com' end.
2014-02-03 13:22:42 - User: SiteScope Administrator. Operation performed: logged in.
2014-02-03 13:28:00 - User: SiteScope Administrator. Operation performed: logged out.
2014-02-03 13:28:10 - User: . Operation performed: Username and password do not match. Failed to login.

Re: Regex SOS!

Ayn — Fri, 07 Feb 2014 17:56:45 GMT

It'd be much easier to debug this if you could post sample events as text instead. That way it's easy to try to create a matching regex on http://regexpal.com/ or something similar.

Re: Regex SOS!

sdorich — Fri, 07 Feb 2014 18:46:19 GMT

Just added the sample events (each timestamp represents a new event). Thanks!

Re: Regex SOS!

somesoni2 — Fri, 07 Feb 2014 19:53:14 GMT

You want to get all the values in quotes as a single field?

Re: Regex SOS!

sdorich — Fri, 07 Feb 2014 19:59:36 GMT

yes. I'd like (if possible) all the values in quotes as a single field.

Re: Regex SOS!

somesoni2 — Mon, 28 Sep 2020 15:50:01 GMT

try this

yourbase search | rex max_match=0 "'(?.*)'" | nomv sis_audit_type

To see if you get correct values.

Re: Regex SOS!

sdorich — Fri, 07 Feb 2014 20:36:20 GMT

Thanks! I tried it and was close but I got everything in b/w the values with quotes. For example, I got this:

ack google' was added to 'SiteScopeTestgoogle.com'

but what I'd really like are the following 2 separate values:

ack google
SSiteScopeTestgoogle.com

Re: Regex SOS!

somesoni2 — Fri, 07 Feb 2014 20:58:02 GMT

Try this one.

yourbase search | rex max_match=0 "'(?<sis_audit_type>[^']*)'\s"

Re: Regex SOS!

sdorich — Fri, 14 Feb 2014 15:32:38 GMT

Thank you! I think that worked pretty well! One question: how can I use that as a regular expression in say props.conf? I tried this:

EXTRACT-Audit Type = '(?[^']*)'\s

but that didn't work.. It seems to only work with the rex search command. Is there something I need to modify to use it in props.conf?

Thanks!