topic Re: Regex in splunk in Splunk Search

Regex in splunk

thambisetty — Fri, 06 Jun 2014 10:59:04 GMT

Hi,
I have data like below,

Contact_Number---------------Name

land="1234" Phone="324"------Kumar
land="3254" phone="458"------Ramu

Now what i want is Phone number of each and every person like below,

Contact_Number---------------Name

Phone="324"----------------Kumar
phone="458"-----------------Ramu

please help me.
Note:In the data there are only two fields one is "contact number" and another one is "Name",
In the Contact Number there are two fields now i want to extract one field for one Name.

Re: Regex in splunk

dmaislin_splunk — Fri, 06 Jun 2014 11:05:09 GMT

 * | rex field=_raw "[Pp]hone="(?<Contact_Number>.+?)"-+(?<Name>.+)"

Where your regex is:

[Pp]hone="(?<Contact_Number>.+?)"-+(?<Name>.+)

Re: Regex in splunk

thambisetty — Fri, 06 Jun 2014 11:20:01 GMT

Thanks for your quick response but its not working..
please do help..

Re: Regex in splunk

dmaislin_splunk — Fri, 06 Jun 2014 11:23:46 GMT

The regex is valid, check it out here: http://regex101.com/r/lY6pS8

Is this data already indexed in Splunk? If so, what is the sourcetype, can you also display the props.conf or transforms.conf for this data?

It this data coming in as a single Splunk event?

Re: Regex in splunk

thambisetty — Mon, 28 Sep 2020 16:48:33 GMT

firewall,"date=10-20-2000 time=01:29:22 name=Donated device_id=123456 log_id=654321 type=""phisical"" subtype=block pri=notice
This is one field in my logs. I need to extract type=""phisical"" as a field. pls help using REX

Re: Regex in splunk

dmaislin_splunk — Fri, 06 Jun 2014 11:31:49 GMT

Just confirming that: type=""physical"" has two double quotes surrounding it? Is this a copied event from Splunk or is it something you manually typed into this answers? The quotes don't make sense since there is a " before date like "date but no end quote.

Re: Regex in splunk

dmaislin_splunk — Fri, 06 Jun 2014 11:35:02 GMT

* | rex field=_raw "\stype=\"\"(?<type>.+?)\"\""

Re: Regex in splunk

sanju1323 — Thu, 12 Jun 2014 06:00:01 GMT

Hi,
I also have same doubt..
Thanks man, it worked for me. But, I need only physical as a field. Is it possible through REX. And please suggest me some good website or something to learn entirely about rex command.
Thank you.