topic Re: RegEx to Find First Match of OR in Splunk Search

RegEx to Find First Match of OR

chrisboy68 — Fri, 22 Apr 2016 18:50:02 GMT

Hi, banging my head...

04/22/2016 09:23:50,865 - ERROR - exception occurred --- FOO BAR
Severity:        Error
Message:         Timeout expired. 
MachineName:     MY MACHINE


04/22/2016 09:23:56,318 - ERROR - exception occurred --- System.Data.SqlClient.SqlException: Timeout expired.  The timeout period elapsed prior to completion of the operation or the server is not responding.
   at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)

I have a single log file that contains the two formats. What I want to do is if the entry has "Message:", then make this the extracted field ErrorMessage, Else If the entry have "ERROR" then, make this the extracted field ErrorMessage.

(?:Message:)|(?:ERROR -)|\s+(?P(?:[^\n]*)) this is the regex I started with and modified with few things and I still can't get it right.

Help appreciated.

Thank you,

Chris

Re: RegEx to Find First Match of OR

ktugwell_splunk — Fri, 22 Apr 2016 19:04:08 GMT

You could do 2 field extractions both producing the same field name ErrorMessage

props.conf

[yoursourcetype]
EXTRACT-1 = Message:\s+(?<ErrorMessage>[A-Za-z0-9 ]+)
EXTRACT-2 = \d{2}\/\d{2}\/\d{4}\s\d{2}:\d{2}:\d{2},\d{3}\s-\sERROR\s-\s(?<ErrorMessage>.+)

That regex isn't the best in the world but you can keep tweaking it to suit your needs

Be sure to add all the possible characters you may see after "Message:" in this part of the regex [A-Za-z0-9 ]

Re: RegEx to Find First Match of OR

chrisboy68 — Fri, 22 Apr 2016 19:09:26 GMT

Thanks, but wouldn't that still execute both EXTRACTs? I just want One or the Other.

Chris

Re: RegEx to Find First Match of OR

ktugwell_splunk — Fri, 22 Apr 2016 19:17:21 GMT

Give it a try, I may be wrong, but I think you'll only only see EXTRACT-2 as ErrorMessage if EXTRACT-1 doesn't exist. Either that or it'll create a multi value field.

Re: RegEx to Find First Match of OR

chrisboy68 — Fri, 22 Apr 2016 20:20:40 GMT

Thanks. You look to be correct! Its working.

Chris

Re: RegEx to Find First Match of OR

ktugwell_splunk — Fri, 22 Apr 2016 20:22:24 GMT

Good stuff!