topic Regex to split field, optional second field in Splunk Search

Regex to split field, optional second field

pgreer_splunk — Thu, 02 Feb 2017 05:51:51 GMT

I have a field that has a pattern where there is a first portion of the string that I'd like to capture into one field, then an optional second field that follows a ':'

For example:

field1
field1:field2
field1
...

I've tried

(?<myfield1>.*):(?<myfield2>.*)

but that only matches if the original field has the "field1:field2".
How should I set up the regex so that it always captures the 'field1' into 'myfield1' and will also capture 'field2' into 'myfield2' if it exists after a ':'?

Re: Regex to split field, optional second field

gokadroid — Thu, 02 Feb 2017 06:06:43 GMT

Try this regex and see if it works out for your case:

...| rex "(?<myField1>[^\s:]+):*(?<myField2>\S*)"

See Extraction Here

Re: Regex to split field, optional second field

pgreer_splunk — Thu, 02 Feb 2017 17:25:16 GMT

That seems to have done it.

So if reading it correctly, the regex says "store into "myField1" one or more characters (in the string) that are NOT whitespace and NOT ':'. Which gobbles up anything until the next match between the groupings, which is zero or more of ':', then store into "myField2" zero or more non-whitespace characters".

That seems to have done it for me. Thanks!