topic Re: Regex for extraction in Splunk Search

Regex for extraction

xvxt006 — Mon, 02 Jun 2014 04:16:05 GMT

Hi,

i want to extract account field and i have events in 2 patterns. One where account has boundaries of @account= and right boundary as & as shown in event 1

2nd pattern is having @account as left boundary and left boundary as space

Event1 pattern is working fine but Event2 gives the whole event after account= which is 123452 HTTP/1.1" 200 1216 109354 "-" "-" "-"

What should i have just to have the account value from Event2 pattern

Event1
?product=%20FILTERS%2016z20r2&account=12334312&country=US HTTP/1.1" 200 3388 218391 "-" "-" "-" "-" "-" "-" "-" "-" "-" "-" "

Event2
?product=2CSY1&account=123452 HTTP/1.1" 200 1216 109354 "-" "-" "-"

Expression used:
(?i)&account=(?P[^&]+)(?:\s|[&].*)

Re: Regex for extraction

kyleharrison — Mon, 02 Jun 2014 05:51:57 GMT

This should work:
(?i)&account=(?P[^&\s]+)

Tested ok on regex101.com with the two events you gave.

Re: Regex for extraction

xvxt006 — Mon, 02 Jun 2014 13:26:54 GMT

Thank you. It worked.

Re: Regex for extraction

xvxt006 — Mon, 02 Jun 2014 13:34:35 GMT

One question some times it has no value in it. as shown below. i was expecting something like - in the captured values. if i want to capture that as well, can i do that?
?product=%20FILTERS%2016z20r2&account=&country=US HTTP/1.1" 200 3388 218391

Re: Regex for extraction

kyleharrison — Mon, 02 Jun 2014 15:47:09 GMT

Then you can change the "+" to "*" to match 0 or many characters ("+" matches 1 or many):

(?i)&account=(?P[^&\s]*)

That would produce: account=""

If you wanted it to be "-", then you can use this eval:

In search:
| eval account=if(isNull(account),"-",account)

In props.conf:

EVAL-account = if(isNull(account),"-",account)