topic Re: Field Extract returns different results than inline rex field in Splunk Search

Field Extract returns different results than inline rex field

coshea — Thu, 11 Dec 2014 16:52:18 GMT

Using Splunk 6.2,

I have a few regex commands that return drastically different results when they are set up using field extractions vs inline seach commands. For example,

Example Log File:

20140915171053989759850769-27156-8.0.0  --Portfolio "MASTER LONG" --PeriodStartDate "January 1, 2014 12:00:00 am" --PeriodEndDate   "September 15, 2014 11:59:59 pm"

Search command (works correctly):

|rex field=_raw "\bPeriodStartDate.*\"(?<PeriodStart>.*)\"" 
|rex field=_raw "\bPeriodEndDate.*\"(?<PeriodEnd>.*)\""
|rex field=_raw "\bPortfolio.*\"(?<Portfolio>.*)\""

Field Extractions:

\bPeriodEndDate.*\"(?.*)\" 
\bPeriodStartDate.*\"(?.*)\" 
\bPortfolio.*\"(?.*)\"

Could I be doing something wrong in the Field Extractions? I used the same regex in Splunk 6.0 with no issues. Any help would be appreciated!

Re: Field Extract returns different results than inline rex field

martin_mueller — Thu, 11 Dec 2014 22:31:44 GMT

In rex \" is an escaped double quote, in the field extraction config it's a backslash followed by a double quote - there's no need to escape the double quote because it's not inside a double-quoted string. Additionally it seems your field extraction config is missing the field names inside the capturing groups.

Another unrelated thought, consider using \s* instead of .* to jump the gap between your string and the quoted field value, the .* greedily matches everything which can lead to unexpected results both in rex and field extraction config.

Re: Field Extract returns different results than inline rex field

coshea — Thu, 18 Dec 2014 20:25:28 GMT

The missing field names inside the capture groups was a bit of a copy and paste error. Here is what I have now:

\bPeriodEndDate.*"(?<PeriodEnd>.*)" 
\bPeriodStartDate.*"(?<PeriodStart>.*)" 
\bPortfolio.*"(?<Portfolio>.*)"

I got rid of the escaped double quote but still can't get it working. If I use \s* it returns the whole log. But if I use .* it returns every event inside of the double quotes.

Thank you for the help

Re: Field Extract returns different results than inline rex field

landen99 — Fri, 04 Sep 2015 12:51:53 GMT

I observed that your solution (above) always captures the end date. Adding \s* as martin suggested does capture everything to the end as you noted. My solution captures exactly what you want efficiently:

-+PeriodEndDate\s+"(?<PeriodEnd>[^"]+)"
-+PeriodStartDate\s+"(?<PeriodStart>[^"]+)"
-+Portfolio\s+"(?<Portfolio>[^"]+)"