topic Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not? in Splunk Search

What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

Thuan — Mon, 28 Sep 2020 18:39:49 GMT

I have the following excerpt of exchange logs. There are more fields before and after this excerpt.

,awells@atcorp.com,awells@atcorp.com,Hi, my dear friend!,

The regex I have developed is:

,(?P[^,]*|,),(?P[^,]*|,),(?P[^,]*|,),]

Using comma (,) as a field delimiter

The first field "sender_address" is parsed as "awells@atcorp.com" - the desired result
The 2nd field "return_path" is parsed as "awells@atcorp.com" - the desired result
The 3rd field "message_subject" is parsed as "Hi," but it should be "Hi, my dear friend!"

I observed that a comma followed by character is field delimiter, but a comma followed by blank space is not.
Question: what is a correct regex for the 3rd field?

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

Thuan — Wed, 21 Jan 2015 19:59:27 GMT

The complete regex should be

,(?P[^,]*|,),(?P[^,]*|,),(?P[^,]*|,),]

Somehow it was modified during the posting.

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

richgalloway — Wed, 21 Jan 2015 20:05:26 GMT

Can the field delimiter be changed? Is there another way to determine the end of field 3 (keyword, etc.)? Can fields be enclosed in quotes?

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

ppablo — Wed, 21 Jan 2015 20:18:02 GMT

Just edited your post and comment so your regex renders correctly on this site.

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

richgalloway — Wed, 21 Jan 2015 20:21:01 GMT

I used to have that ability until the site was upgraded. How do I get it back?

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

ppablo — Wed, 21 Jan 2015 20:49:25 GMT

Ah that's not good at all, thanks for letting me know. Let me look into it and I'll get back to you. (are you "Rich" in the IRC #splunk channel? If yes, I pinged ya earlier to chat about this, but wasn't sure if that was you lol)

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

richgalloway — Wed, 21 Jan 2015 20:50:45 GMT

No, not me. I don't use IRC.

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

ppablo — Wed, 21 Jan 2015 20:58:08 GMT

Ah ok haha woops. Well just to get more info, you haven't been able to edit other users' posts since this site was updated back in September?

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

richgalloway — Wed, 21 Jan 2015 20:59:56 GMT

That's correct.

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

wpreston — Wed, 21 Jan 2015 21:23:04 GMT

This regex appears to work as you want, and should work as long as there is a comma at the end of field three:

,(?<Field1>[^,]+),(?<Field2>[^,]+),(?<Field3>.*),

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

Thuan — Thu, 22 Jan 2015 17:41:34 GMT

I tested and your solution does not work. The example string is listed below
,awells@atcorp.com,awells@atcorp.com,Hi, my dear friend! ,

Focusing on the 3rd field, the last two characters include a space between the ! , (exchamation mark + space + comma)
The field separator at the end of the 3rd field should be a space+comma. I have tried this

,(?[^,]+),(?[^,]+),(?.)\s, it does not work but
,(?[^,]+),(?[^,]+),(?.|\s), does

I do not understand why the first one does not work as the field separator is a space+comma

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

Thuan — Thu, 22 Jan 2015 17:49:12 GMT

Correction

,(?[^,]+),(?[^,]+),(?.)\s, it does not work but
,(?[^,]+),(?[^,]+),(?.|\s), does

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

Thuan — Thu, 22 Jan 2015 17:50:02 GMT

there is backward slash before the s

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

richgalloway — Thu, 22 Jan 2015 18:08:14 GMT

If the third field always ends with space+comma then this works for me:

,(?<field1>[^,]+),(?<field2>[^,]+),(?<field3>.+) ,

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

Thuan — Thu, 22 Jan 2015 19:12:33 GMT

Thank you.

What is the difference between " " (blank space) and \s embedded in regex statements?

Re: What is the regex for a comma followed by a character as a field delimiter, but a comma followed by blank space is not?

richgalloway — Thu, 22 Jan 2015 19:17:46 GMT

\s matches any white space (space, tab, etc.) whereas ' ' matches only space. \s is probably best practice. In your case, they should be interchangeable.