topic Regex Help in Splunk Search

Regex Help

theouhuios — Thu, 24 Jul 2014 13:23:44 GMT

I am struggling with the regex match on the below pattern. I need to capture etl_fdaf_33424134 . Pretty much after the first _ . Any help?

/tmp/Jams/Apps/fgff_etl_fdaf_33424134.log 
/tmp/Jams/Apps/abc_etl_xyz_1111111.log

theouhuios — Thu, 24 Jul 2014 13:24:32 GMT

I am not able to make the regex stop at the first _ . Its always looking till the last one. Is there a way to force it match just on the first _

martin_mueller — Thu, 24 Jul 2014 13:28:56 GMT

This should do:

_(?<fieldname>.*?)\.log

I've assumed you don't want the .log captured based on your example.

theouhuios — Thu, 24 Jul 2014 14:28:59 GMT

That works. I wonder why I was trying to make it work from Apps/ . This is simple to write and understand. Thanks

martin_mueller — Thu, 24 Jul 2014 15:16:53 GMT

That's possible as well, just make sure to be precise in what you match afterwards:

Apps/[^_]+_(?<fieldname>.*?)\.log

Alternatively, use non-greedy quantifiers:

Apps/.+?_(?<fieldname>.*?)\.log