topic Re: How do I edit the regex in my search to extract a part of a string? in Splunk Search

How do I edit the regex in my search to extract a part of a string?

kumina — Wed, 24 Jun 2015 11:51:20 GMT

I have a log:

 BL: | LL: INFO | TS: 1234 | AR: RxC_16.00.37.01 | STORE:  :BROADCAST |
 USER: BROADCAST | HOST: BROADCAST | APPSERVER: rri | MSGID: CINTERFACE
 |SC: [Profile] | MSG: ISP Broadcast Received for

I want to get MSGID-SC (CINTERFACE-Profile) from the string above.

For this i am trying to use rex command:

index=rx_connect "USER: BROADCAST" |rex field=_raw
"MSGID:\s(?<MSGID>[^\|]*)\s\|\SC:\s\[(?<SC>[^\]]*)\]" | eval
someNewField=MSGID."-".SC`

But it is not working. Please suggest further.

Re: How do I edit the regex in my search to extract a part of a string?

alacercogitatus — Wed, 24 Jun 2015 11:55:53 GMT

Your regex has a Typo. Try this:

index=rx_connect "USER: BROADCAST" |rex field=_raw "MSGID:\s(?<msgid>[^\|]+)\s\|SC:\s\[(?<sc>[^\]]*)\]" | eval someNewField = msgid."-".sc

Re: How do I edit the regex in my search to extract a part of a string?

kumina — Thu, 25 Jun 2015 05:24:11 GMT

Hi,

I am still getting whole logs instead of

MSGID-SC

example:(CINTERFACE-Profile)

Re: How do I edit the regex in my search to extract a part of a string?

chimell — Thu, 25 Jun 2015 12:28:24 GMT

Hi kumina

Try this search code it works well

 index=rx_connect "USER: BROADCAST" |rex field=_raw "MSGID:\s(?P<msgid>[^\|]+)\s"|rex field=_raw "SC:\s\[(?P<sc>[^\|]+)\]"|rex field=_raw "\|\s(?P<field1>[\w]+)\:\sCINTERFACE"|rex field=_raw "\|(?P<field2>[\w]+)\:\s\[Profile]"|eval someNewField = field1."-".field2."  (".msgid."-".sc.")" |table msgid sc field1 field2 someNewField

Look at the following screen capture

Re: How do I edit the regex in my search to extract a part of a string?

kumina — Fri, 26 Jun 2015 10:15:04 GMT

Thanks Chimell....
Now it works

Re: How do I edit the regex in my search to extract a part of a string?

kumina — Fri, 26 Jun 2015 10:17:00 GMT

Hi,

If value of msgid and sc in above logs is not constant and we want to extract that part then what will be the string

Re: How do I edit the regex in my search to extract a part of a string?

chimell — Fri, 26 Jun 2015 14:33:59 GMT

Thanks too .
Test the second result and think to vote and accept

Re: How do I edit the regex in my search to extract a part of a string?

chimell — Fri, 26 Jun 2015 15:29:43 GMT

Hi kumina

If msgid and sc are not constant , use the max_match option and mvindex command to solve your problem

Try this search code

 index=rx_connect "USER: BROADCAST"|rex field=_raw  max_match=0 "\|\s\w+\:\s(?P<msgid1>[^\|]+)\s"|eval msgid=mvindex(msgid1,7)
|rex field=_raw "\[(?P<sc>[^\|]+)\]"|rex field=_raw "\|\s(?P<field1>[\w]+)\:\sCINTERFACE"|rex field=_raw "\|(?P<field2>[\w]+)\:\s\[Profile]"|eval someNewField = field1."-".field2."  (".msgid."-".sc.")" 
|table msgid sc field1 field2 someNewField

see result