topic Re: REGEX help in Splunk Search

REGEX help

rpascua — Mon, 24 Mar 2014 20:42:55 GMT

Please help with REGEX problem.

Sample Data:

Bank summary of John_Doe2/default (0.03 seconds): deposit (15 dollars, 0 cents), withdrawal (2 dollars, 0 cents).

This is the regex I use to extract the numbers. It works.

| rex "\sdeposit \((?<Deposit>\d+)" | rex "\s*withdrawal \((?<Withdrawal>\d+)" | table Deposit Withdrawal | addcoltotals

Now I want to include "Names" in my search and put them in one table along with the rest of the numbers. I tried the REGEX below, but I keep getting blanks in the "Name" column. What am I missing here?

| rex "\sof \((?<Name>\([A-Za-z0-9_])" | rex "\sdeposit \((?<Deposit>\d+)" | rex "\s*withdrawal \((?<Withdrawal>\d+)" | table Name Deposit Withdrawal | addcoltotals

Re: REGEX help

martin_mueller — Mon, 24 Mar 2014 21:37:54 GMT

Try this:

| rex "\sof (?<Name>[A-Za-z0-9_]+)" | rex "\sdeposit \((?<Deposit>\d+)" | rex "\s*withdrawal \((?<Withdrawal>\d+)" | table Name Deposit Withdrawal | addcoltotals

There were some extra opening parentheses, and no + quantifier.

Note, if you can control that output it's easier to change it to key=value pairs - then you don't need to mess around with regular expressions for field extraction.

Re: REGEX help

rpascua — Tue, 25 Mar 2014 17:13:31 GMT

It's the little things. Thanks! It works!

Re: REGEX help

martin_mueller — Tue, 25 Mar 2014 18:10:06 GMT

Great. Don't forget to mark this as solved.

Re: REGEX help

rpascua — Mon, 28 Sep 2020 16:13:53 GMT

I posted a new question titled "Regex Money" so feel free to look it up and post your response.

Here's my new question:
If John took money out three times within a 24-hour period, using the REGEX below, I would have a 3-line output.

But all I need is a one-liner like this:

John (Deposit: 0) (Withdrawal: 110) (Total Withdrawal: 110)

I tried multiple combinations but keep coming up emp