topic Re: How do I write the regex to extract fields from another existing field? in Splunk Search

How do I write the regex to extract fields from another existing field?

skender27 — Mon, 07 Sep 2015 14:18:17 GMT

Hi,

I need to extract a field from another field, no metadata fields.

The existing field (let's call it existing_field) has the following value:
class = 'blablabla' AND category = 'blablabla' AND ...

As you see the new two fields I need to extract are class and category and they are separated from AND.
What is the regex to extract them so I can add it to the .conf file?

Thanks,
Skender

Re: How do I write the regex to extract fields from another existing field?

lquinn — Mon, 07 Sep 2015 14:42:20 GMT

Can you give a sample of a whole event?

Re: How do I write the regex to extract fields from another existing field?

DMohn — Mon, 07 Sep 2015 14:56:54 GMT

You could use the rex command
your_search_here | rex field=existing_field "^.*\= '(?\w+)'.*\= '(?\w+)'.*$"

More details on the command can be found here: http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/rex

Otherwise try to use the graphical field extractor: http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/ExtractfieldsinteractivelywithIFX

Re: How do I write the regex to extract fields from another existing field?

skender27 — Mon, 07 Sep 2015 15:02:23 GMT

Ok I wrote this one and it works for the sample:

^(?P\w+)\s\=\s\'\w+\s\w+\s\w+\'\sAND(?P\s\w+)

Here you have the sample text:

NAME OF THE FIELD
existing_field_from_json
VALUE
class = 'kdjaldja' AND category = 'shdgahgdhadgjad' AND some_other_text_here...

Now, how to put this regex to extract the information from the existing field?
And how to insert the eval stanza in the props.conf?

Skender

Re: How do I write the regex to extract fields from another existing field?

skender27 — Mon, 07 Sep 2015 15:13:39 GMT

Here is a sample of the data Iquinn:
"existing_field": "class = 'jhaskjdhsakjdhsakjdh' AND category = 'dhjkashdjkahdkajhdkaj' AND (hdsgahsdgasdgadgjjasgdhagdhasgd"...

as far as I know this is part of JSON data...

Thanks,
Skender

Re: How do I write the regex to extract fields from another existing field?

skender27 — Mon, 07 Sep 2015 15:45:43 GMT

I added in the sourcetype in my props.conf:

EXTRACT-my_extraction = (?P\w+)\s\=\s\'\w+\s\w+\s\w+\'\sAND\s(?P\w+) in existing_field

but I do not see the new fields yet...

Re: How do I write the regex to extract fields from another existing field?

richgalloway — Mon, 07 Sep 2015 15:46:53 GMT

Try this:

... | rex field=existing_field "class = '(?P<class>\w+)' AND category = '(?P<category>\w+)'" | ...

Re: How do I write the regex to extract fields from another existing field?

skender27 — Tue, 29 Sep 2020 07:10:41 GMT

It returns no errors but it doesn't work.
this regex is ok:
(?P\w+)\s\=\s\'\w+\s\w+\s\w+\'\sAND\s(?P\w+)

and here is a piece of sample data:
"existing_field": "class = 'Servizio...' AND category = 'Materiale...' AND ( ticket_type = 'Change Request' and ticket_impact_code = '2' ) AND ( ticket_type = 'Change Request' and ticket_urgency_code = '2' )"...

Re: How do I write the regex to extract fields from another existing field?

richgalloway — Mon, 07 Sep 2015 18:03:55 GMT

You need to name the fields you are extracting (perhaps you did so and the editor dropped them). What's more, the capturing groups need to be around the right side of the equals sign or all you will capture is the field name.

Re: How do I write the regex to extract fields from another existing field?

richgalloway — Mon, 07 Sep 2015 18:10:52 GMT

This regex will work if the fields contain only word characters. Try this as an alternative:

class = '(?P<class>[^ ]+)' AND category = '(?P<category>[^ ]+)'

Re: How do I write the regex to extract fields from another existing field?

skender27 — Tue, 29 Sep 2020 07:10:49 GMT

I comfirm: the values are only word characters.

I tried this but I get no new fields extracted:
| rex field=sql_where_clause "class = '(?P[^ ]+)' AND category = '(?P[^ ]+)'"

should I cancel the extraction row I added in relative sourcetype in the props.conf?

Skender

Re: How do I write the regex to extract fields from another existing field?

skender27 — Tue, 29 Sep 2020 07:10:52 GMT

sql_where_clause is the existing_field

Re: How do I write the regex to extract fields from another existing field?

skender27 — Tue, 08 Sep 2015 10:51:48 GMT

And how about extracting entire strings (with white spaces included), not only words?

Re: How do I write the regex to extract fields from another existing field?

skender27 — Tue, 29 Sep 2020 07:10:57 GMT

here is some sample text:

"existing_field: class = 'Service One...' AND category = 'Materials Two...' AND ( ticket_type = 'Change Request' and ticket_impact_code = '2' ) AND ( ticket_type = 'Change Request' and ticket_urgency_code = '2' )"...

Re: How do I write the regex to extract fields from another existing field?

richgalloway — Tue, 08 Sep 2015 12:26:45 GMT

This regex extracts fields with spaces from your example.

class = '(?P<class>.*?)' AND category = '(?P<category>.*?)'

Re: How do I write the regex to extract fields from another existing field?

skender27 — Tue, 08 Sep 2015 13:18:18 GMT

Thanks a lot:

I resolved it this way:

| rex field=existing_field  "class = (?P.*?) AND category = (?P.*?) AND"

Skender