topic Re: Help with regex in Splunk Search

Help with regex

pdash — Thu, 27 Feb 2014 20:08:44 GMT

I have a log format that uses space as delim and "" as delim when we have space in between. How should i write the rex to split these fields out?

02-27-2014/04:30:21-0700 11.23.13.41 64.13.30.50 96.42.90.80 HTTP/1.1 GET abc.defghi.com /cs/aabd/ajax/ajax.wp 200 25575 642 35633 "?lcid=2401&mobile=false" "-" "TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0" "-"

Re: Help with regex

lukejadamec — Thu, 27 Feb 2014 20:51:40 GMT

What version of splunk are you using?

Re: Help with regex

pdash — Thu, 27 Feb 2014 20:52:41 GMT

splunk 5.0

Re: Help with regex

aholzer — Thu, 27 Feb 2014 21:08:47 GMT

If I understand correctly, you want the following:
field1="?lcid=2401&mobile=false"
field2="-"
field3="TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0"
field4="-"

Is this correct?
If the number of fields (extractions) is always the same, you could define a regex as follows:

"(?P[^"]*)"\s"(?P[^"]*)"\s"(?P[^"]*)"\s"(?P[^"]*)"

If the number of fields is not fixed, then the above won't work

Re: Help with regex

lukejadamec — Thu, 27 Feb 2014 21:10:50 GMT

Are these the fields you're trying to extract?
02-27-2014/04:30:21-0700
11.23.13.41
64.13.30.50
96.42.90.80
HTTP/1.1
GET
abc.defghi.com
/cs/aabd/ajax/ajax.wp
200
25575
642
35633
"?lcid=2401&mobile=false"
"-"
"TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0"
"-"

Re: Help with regex

pdash — Thu, 27 Feb 2014 21:12:16 GMT

Correct. So my delims would be both space and " ". And the number of fields is always same.

Re: Help with regex

lukejadamec — Thu, 27 Feb 2014 21:40:38 GMT

I would use this, but not in a search string with rex. You should use EXTRACT in props.conf with other parameters for the sourcetype.

[yoursourcetype]

EXTRACT-multifieldx = ^(?<datetimetz>\d+-\d+-\d+/\d+:\d+:\d+-\d+)\s(?<IP1>\d+\.\d+\.\d+\.\d+)\s(?<IP2>\d+\.\d+\.\d+\.\d+)\s(?<IP3>\d+\.\d+\.\d+\.\d+)\s(?<protocol>.*)\s(?<method>\w+)\s(?<site>.*)\s(?<path>.*)\s(?<metric1>\d+)\s\s(?<metric2>\d+)\s(?<metric3>\d+)\s(?<metric4>\d+)\s"(?<string1>[^"]+)"\s"(?<string2>[^"]+)"\s"(?<string3>[^"]+)"\s"(?<string4>[^"]+)"\s