topic Re: First match from end of the line regex in Splunk Search

First match from end of the line regex

subtrakt — Mon, 19 Feb 2018 19:33:28 GMT

Hi Everyone,

Trying to get the expression to read first match from the end off the line and not the beginning of the line.

| makeresults | eval TEST="beginning of line Facility=test341 Message=test123 end of line" | rex field=TEST max_match=0 "(?i)(?<testfromend>(Facility\=|Message\=)[^$]*)" | mvcombine testfromend

Was hoping this would extract "Message=test123 end of line". Instead i get Facility= and everything after because its reading from the beginning of the line still.

Re: First match from end of the line regex

horsefez — Mon, 19 Feb 2018 19:56:31 GMT

Hey subtrakt,

why not use (?i)(?<testfromend>Message\=[^$]*) then?

BUT... if you want to extract the value of facility and of message do the following:
(?i)Facility=(?<facility>[^\s]*)\s*Message=(?<message>.*)
https://regex101.com/r/DGZX5X/1

Re: First match from end of the line regex

bjoernhansen — Mon, 19 Feb 2018 19:58:45 GMT

Hey subtrakt,

try this one:

(?i).*(?<testfromend>(Facility\=|Message\=)[^$]*?)$

Update: even better:

(?i)(?<testfromend>(Facility\=|Message\=)[^\=]*?)$

Re: First match from end of the line regex

subtrakt — Mon, 19 Feb 2018 20:10:36 GMT

Thanks Pyro.

Just experimenting without using eval and creating unnecessary fields. The condition requires message to always take precedence.

Sometimes Message= is not in the log. Sometimes it is. When message is not in the log, it needs to capture Facilility to end of line.

Re: First match from end of the line regex

subtrakt — Mon, 19 Feb 2018 23:28:33 GMT

I ended up using the first solution.

I guess the .* enables the search from end of line and a more flexible option.

Re: First match from end of the line regex

subtrakt — Tue, 20 Feb 2018 00:25:06 GMT

There's other cases in the logs that require different conditions searching from the end of the line.

After testing around all those conditions I found the answer selected was the best global option.