topic Re: Specific rex doesnt seem to work in Splunk Search

Specific rex doesnt seem to work

clintla — Fri, 24 Jun 2011 21:05:22 GMT

Have 3 sets of drives that are listed differently by different systems.

FC SSD

SATAII SSD

Fibre Channel

SATAII

Really its just SATA, Fibre Channel & SSD & I'd like to group them as such.

I've tried many variations of

"Drive\sType:\s+(?<drive_tier>Fibre|SATAII\\s\\s|/SSD/)"

The above SHOULD work IMO. but it only lists the first 2. I've tried many
variations & either it finds the first 2 or lists all 4.

If I take out the \s\s on the plain SATA then it will group the SATA SSD's
with it- its not what I want but its the only grouping I've been able to
see with this. The 2 SATAII's seem to make this a little more difficult.

Anyone have any suggestions to try?

Re: Specific rex doesnt seem to work

jbsplunk — Fri, 24 Jun 2011 21:58:22 GMT

could you post an example of some events that you'd like to apply the rex to so we can get an idea of the format for the events?

Re: Specific rex doesnt seem to work

clintla — Fri, 24 Jun 2011 22:35:08 GMT

Drive Type: FC SSD

Drive Type: Fibre Channel

Drive Type: SATAII

Drive Type: SATAII SSD

Above is exacltly the way they appear.
I'd like to just have 3 groups.

SATAII

SSD (the 2 SSD's combined)

FIBRE

Re: Specific rex doesnt seem to work

malberto — Mon, 27 Jun 2011 16:44:45 GMT

Why are you doing "\s" in one place and "\s" in another!
Why do you have "SATAII\s\s" when sometimes you have "SATAII" and sometimes "SATA SSD". Your regex will match either. You want: "...|SATAII|..."
It seems to be that what you REALLY want is just:

"Drive\sType:\s+(?.+?)$"

Any DriveType until the newline.

Re: Specific rex doesnt seem to work

clintla — Mon, 27 Jun 2011 17:28:37 GMT

SATAII & SATAII SSD are separate. I want those 2
Fibre SSD & SATAII SSD's to be grouped togather.

When I put in the \s\s it separated SATAII vs. SATA SSD.

I thought if I had |SSD that it would pickup anything
that had SSD in the string.. seems like a nice idea- but
it doesnt work

Re: Specific rex doesnt seem to work

Paolo_Prigione — Mon, 27 Jun 2011 18:25:34 GMT

Here you go:

"Drive Type: (?:SATAII |FC )*(?<drive_tier>Fibre|SATAII(?! SSD)|SSD)"

Results:

Drive Type: SATAII SSD --> SSD
Drive Type: SATAII --> SATAII
Drive Type: Fibre Channel --> Fibre
Drive Type: FC SSD --> SSD

There's no way to have it output an uppercase "FIBRE" as regexes only output what was in the original text.