topic Re: mulitple regex extraction in Splunk Search

mulitple regex extraction

dbcase — Wed, 08 Feb 2017 17:17:17 GMT

Hi,

I'm trying to extract two fields from the below data

02-08 07:33:41.211 E/Rules_LightBaseAction( 2660): com.icontrol.device.DeviceException: Failed to turn light off.


02-08 07:30:19.611 E/Rules_LightBaseAction( 2660): Caused by: com.icontrol.zigbee.service.ZigbeeServiceException: executeCommand returned failure.

rulename=LightBaseAction and result=Failed to turn light off OR executeCommand returned failure

my attempt at the regex works for the rulename but not so much for the result.... What am I missing on the below regex?

E\/Rules_(?<rulename>\w+)(DeviceException|ZigbeeServiceException):\s+(?<result>$)

Re: mulitple regex extraction

vasanthmss — Wed, 08 Feb 2017 17:24:02 GMT

try something like this,

base search | rex "E/Rules_(?<rulename>\w+).*(DeviceException|ZigbeeServiceException):\s+(?<result>.*)$"

Hope this will helps you.

Re: mulitple regex extraction

dbcase — Wed, 08 Feb 2017 17:25:02 GMT

attempt #2 at regex but still no joy . E\/Rules_(?<rulename>\w+)Exception:\s(?<result>.+[^.])

Re: mulitple regex extraction

dbcase — Wed, 08 Feb 2017 17:27:59 GMT

Hi Vasanthmss!

Thank you! that helped! The final regex looks like this . E\/Rules_(?<rulename>\w+).*Exception:\s(?<result>.+[^.])

Re: mulitple regex extraction

vasanthmss — Wed, 08 Feb 2017 17:59:19 GMT

glad that helped.. accept the answer.