topic Re: How to create a regular expression to extract this string from four types of patterns in my sample data? in Splunk Search

How to create a regular expression to extract this string from four types of patterns in my sample data?

virtualme — Sun, 19 Jun 2016 06:57:40 GMT

Hi,

I have the following 4 kinds of text in logs in a single file. I want to extract the string - Customer Num (starting with a number and followed by letters). I wish to write 1 single regex search which can handle all types of logs.

I have been able to handle & extract the Customer Number from first 3 types of pattern (one regex for each row, which is not optimal), but the fourth is turning to be a problem because it is sort of a superset of the two lines of log..

Log Text -
"/GW_SS/SPut/s/123abc/”
"/GW_SS/SPut/icam/165abc/”
“/GW_SS/GtImFile/2245dbvf/ngH”
"/GW_SS/123xy/GetPendingP"
"/GW_SS/009876/connectInfo"
I have to extract "123abc" / "165abc", "2245dbvf" , "123xy" & "009876" which is a Customer ID from each row of logs. This string I need to extract always begins with a number, and have letters following it..

Can someone please help.. I want to manage all these with 1 single regex..

Re: How to create a regular expression to extract this string from four types of patterns in my sample data?

richgalloway — Sun, 19 Jun 2016 18:30:59 GMT

This regex string works with your sample data

 (?<user>\d+\w+)

Re: How to create a regular expression to extract this string from four types of patterns in my sample data?

ddrillic — Sun, 19 Jun 2016 21:44:00 GMT

Work like a charm -

base search 
| eval data="/GW_SS/SPut/s/123abc/"
| rex  field=data "(?<user>\d+\w+)"

Re: How to create a regular expression to extract this string from four types of patterns in my sample data?

richgalloway — Sun, 19 Jun 2016 22:15:13 GMT

Please accept the answer.

Re: How to create a regular expression to extract this string from four types of patterns in my sample data?

ddrillic — Mon, 20 Jun 2016 10:52:43 GMT

Not my question ; -)

Re: How to create a regular expression to extract this string from four types of patterns in my sample data?

virtualme — Mon, 20 Jun 2016 21:48:54 GMT

Thanks for your response... This serves the the type 4 & 5 of the logs...
Although I have reg-ex for the first 3 types, I am looking for a solution wherein I can handle all 4 types in 1 single reg-ex to extract the Customer ID..
Do you think its possible?

Re: How to create a regular expression to extract this string from four types of patterns in my sample data?

virtualme — Mon, 20 Jun 2016 21:50:01 GMT

Re: How to create a regular expression to extract this string from four types of patterns in my sample data?

sundareshr — Mon, 20 Jun 2016 22:55:35 GMT

This should capture all scenarios

\/(?<user>\d+\w*)

Re: How to create a regular expression to extract this string from four types of patterns in my sample data?

virtualme — Tue, 21 Jun 2016 03:51:48 GMT

Hey.. Thanks for the answer.. It's good as a regular expression, but for some reason isn't working out in Splunk.. The "/" expression makes the results go haywire..