topic Re: How to edit my regular expression to extract these fields from my sample data? in Splunk Search

How to edit my regular expression to extract these fields from my sample data?

dbcase — Tue, 29 Sep 2020 11:22:50 GMT

Hi,

I have the below data

10.210.192.15 - - [12/Oct/2016:19:59:43 -0400] "GET /rest/icontrol/login?expand=sites,instances,points,functions HTTP/1.1" 401 6 "-" "Mozilla/5.0 (Linux; Android 6.0.1; SAMSUNG-SM-G920A Build/MMB29K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/53.0.2785.124 Mobile Safari/537.36"

10.210.192.5 - - [12/Oct/2016:19:50:06 -0400] "GET /rest/icontrol/login?expand=sites,instances,points,functions HTTP/1.1" 401 6 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_0_2 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Mobile/14A456"

And I'm trying to match on the OS for Android or the iPhone. I have this much of the regex (Android|iPhone) (?P<os>) but I'm now stumped as to what the remaining portion should be. I need to capture 6.0.1 from the first line and 10_0_2 from the second line.

Re: How to edit my regular expression to extract these fields from my sample data?

somesoni2 — Thu, 13 Oct 2016 22:05:37 GMT

How about this

Updated

your base search | rex  "((Android)|(iPhone OS)) (?<os>[^\s\;]+)"

Re: How to edit my regular expression to extract these fields from my sample data?

aljohnson_splun — Thu, 13 Oct 2016 22:08:19 GMT

https://regex101.com/r/oeF93v/1

Re: How to edit my regular expression to extract these fields from my sample data?

dbcase — Tue, 29 Sep 2020 11:22:52 GMT

Hey Somesoni2!

Close, that grabs the second line 10_0_2 but not the first line 6.0.1

Re: How to edit my regular expression to extract these fields from my sample data?

dbcase — Thu, 13 Oct 2016 22:11:43 GMT

Hi,

Yes I'm already using that site but still stumped.

Re: How to edit my regular expression to extract these fields from my sample data?

somesoni2 — Thu, 13 Oct 2016 22:14:39 GMT

How about now?

Re: How to edit my regular expression to extract these fields from my sample data?

dbcase — Thu, 13 Oct 2016 22:16:57 GMT

BINGO!!!! Many thanks!!!!

Re: How to edit my regular expression to extract these fields from my sample data?

lakromani — Fri, 14 Oct 2016 06:19:08 GMT

You do not need it inner parentheses, and you do not need to escape the ;, so this should do:

 your base search | rex  "(Android|iPhone OS) (?<os>[^\s;]+)"