topic Re: How to write regex for filtering values with .,: in same field in Splunk Search

How to write regex for filtering values with .,: in same field

umsundar2015 — Fri, 30 Dec 2016 11:09:20 GMT

Hi,

I have below values in same field , i have to take the values(characters) before : .If the first value is ip address then full ip have to taken.
for example ,

10.102.208.108:sqlexpress( need full ip address from here)
ALATDEV1:OMGEO(Need ALATDEV1 from here)
SWSYBQ21.dtcc.com:1025 (Need SWSYBQ21 from here )
SWTEPQ0004.corp.dtcc.com:172.21.168.62:172.21.168.62:0:ServiceList.WebInspect Data Server (Need SWTEPQ0004)

Please suggest me .

Re: How to write regex for filtering values with .,: in same field

gcusello — Fri, 30 Dec 2016 11:59:12 GMT

Hi umsundar2015,
Try something like this

^(?<field>[^:]*)

Bye.
Giuseppe

Re: How to write regex for filtering values with .,: in same field

niketn — Fri, 30 Dec 2016 12:19:01 GMT

Hi @umsundar2015,
Will it be possible for you to give complete event as example i.e. whether there is a pattern before and pattern after the field you are trying to extract?

If not can you try Interactive Field Extraction to let Splunk generate regular expression for the required field extraction. In your test machine you can add some sample logs and use Extract New Fields option.

Refer to attached screenshot for a sample regular expression based IFX.

Re: How to write regex for filtering values with .,: in same field

umsundar2015 — Fri, 30 Dec 2016 12:53:32 GMT

Hi,

Thank you for your rex.

But still for this CVSQLP0001.corp.reds.com:MSSQLSERVER , i am getting CVSQLP0001.corp.reds.com

My requirement is to get CVSQLP0001 for the above scenario too.

Pls advice me .

Re: How to write regex for filtering values with .,: in same field

gcusello — Fri, 30 Dec 2016 13:11:19 GMT

try this

^(?<field>[^:.]*)

Bye.
Giuseppe

Re: How to write regex for filtering values with .,: in same field

umsundar2015 — Fri, 30 Dec 2016 13:46:01 GMT

now the ip address is not proper , iam getting 10 alone for 10.102.208.108:SQLEXPRESS,
Pls suggest

Re: How to write regex for filtering values with .,: in same field

gcusello — Fri, 30 Dec 2016 14:14:52 GMT

try this

^(?<field>((\d+\.\d+\.\d+\.\d+)|(\w+))*)

Bye.
Giuseppe

Re: How to write regex for filtering values with .,: in same field

gokadroid — Fri, 30 Dec 2016 23:55:10 GMT

This should work for all the cases if say the values are in field called testField:

your query to return testField
| rex field=testField "^(?<myField>(([\d\.]+)|(\w+)))[:.]"
| table myField

See extraction here.
You can also replace the last capturing group [:.] to include comma if required [:.,]

Re: How to write regex for filtering values with .,: in same field

umsundar2015 — Mon, 02 Jan 2017 11:07:41 GMT

hi gokandroid,

Thank you and this works perfectly ..