topic Re: Regex question in Splunk Search

Regex question

gnovak — Mon, 28 Sep 2020 12:12:36 GMT

I can't seem to figure this one out. I have a line in a log like this:

2012-08-07 12:35:49,138 [http-10.40.231.33-40081-11] INFO info.mycompany.WAT.report.ReportService - USER [6913-ZZ] downloading /billing/2012/May/Statement.pdf

And here is my splunk search with regex:

sourcetype="EPPWEB" source="/opt/log//web_server/info.log" WAT | rex field=_raw "USER (?P[\d+-\w\w]) downloading /[^/]+/[^/]+/(?P\w.\w+)+$"

For the field "filename" i have results like ".pdf" or ".txt". I'd like to get the entire file name ....Statement.pdf

What am I missing or not missing?

Re: Regex question

sdaniels — Tue, 07 Aug 2012 15:03:52 GMT

Maybe (?Pw+\.w+). Escape the period just to make sure.

Re: Regex question

christopher_hod — Tue, 07 Aug 2012 15:07:19 GMT

Try making the end look like this:
downloading /[^/]+/[^/]+/(?P[\w.])$"

Re: Regex question

gnovak — Tue, 07 Aug 2012 15:08:45 GMT

When I take the ending + away the field "filename" isn't extracted any more.

Re: Regex question

gnovak — Mon, 28 Sep 2020 12:12:38 GMT

sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT | rex field=_raw "USER (?P[\d+-\w\w]) downloading /[^/]+/[^/]+/(?Pw+.w+).$" doesn't work. Even taking away the $ doesn't work either. 😞

Re: Regex question

dmaislin_splunk — Tue, 07 Aug 2012 15:20:12 GMT

rex field=_raw "USER.*/(?.+?)$"

Re: Regex question

gnovak — Mon, 28 Sep 2020 12:12:41 GMT

This actually worked. I took some of your example and added it. sourcetype="EPPWEB" source="/opt/log//web_server/info.log" WAT | rex field=_raw "USER (?P[\d+-\w\w])./(?.+?)$"

Thanks for the help

Re: Regex question

dmaislin_splunk — Tue, 07 Aug 2012 15:36:34 GMT

Awesomeness!