topic Re: How to create a regular expression for a field in a log file? in Splunk Search

How to create a regular expression for a field in a log file?

mderosa — Mon, 21 Nov 2016 16:03:31 GMT

Hi, first of all thanks for help me.

I have this log file:

2016-11-21T16:29:25.690+0100 INFO    2867 com.l7tech.log.custom.csm: -4: SplunkService=LIVEpolicy_csmws_poas
... 20 lines omitted ...
                  <![CDATA[
                     <CategoryAvailabilityRequest>
    <SessionInfo>
        <SessionID>value</SessionID>
        <Profile>A</Profile>
        <Language>DEU</Language>
        <Version>1</Version>
    </SessionInfo>
    <BookingContext>
        <AgencyID>value</AgencyID>
        <BookingContactName>XML Test</BookingContactName>
        <MarketCode>value</MarketCode>
        <BookingCurrencyCode>value</BookingCurrencyCode>
        <LanguageCode>value</LanguageCode>
        <OfficeCode>DEU</OfficeCode>
    </BookingContext>
    <CruiseComponent>
        <ComponentID>value</ComponentID>
        <PromotionCode>didu20198212</PromotionCode>

I need to create the field OfficeCode then take the value to create a dashboard.

Splunk in automatic way do not recognize this field, could you help me to create a regular expression?

Thanks
Massimiliano

Re: How to create a regular expression for a field in a log file?

sundareshr — Mon, 21 Nov 2016 17:14:07 GMT

Try this

... | rex "OfficeCode\>(?<office_code>\w+)\<" |...

Re: How to create a regular expression for a field in a log file?

gokadroid — Mon, 21 Nov 2016 18:43:27 GMT

The one given by @sundareshr should work fine if office code has \w worth of data, however if there are more than \w type of data that can be part of officeCode then you can give this a try as well as \w only covers [a-zA-Z0-9_]:

... | rex "OfficeCode\>(?<OfficeCode>[^\<]+)\<" | table OfficeCode

Re: How to create a regular expression for a field in a log file?

mderosa — Tue, 22 Nov 2016 08:38:34 GMT

Thank you both the expression works well!