topic Re: How to find which group was matched in a regex when multiple groups are extracted to the same field? in Splunk Search

How to find which group was matched in a regex when multiple groups are extracted to the same field?

girrajubharath — Fri, 07 Jul 2017 19:51:01 GMT

I am using multiple capturing groups in regex and extracting the value of multiple groups to same field.

For ex:

(group1)|(group2)|(group3)|(group4)|(group5)

I have defined a field extraction to extract values of group1, group2 and group3 to one field ( say field1 ). Now If some data matched above regex (say group2 is matched), its value is extracted to field1. At this point I know that one of the first 3 groups matched. But is there a way to find out which group matched out of the first 3 groups? I had to extract multiple group values to a single field because all those groups can contain similar data and all the groups does not get logged in one log statement. Also there are so many capturing groups and I don't want to have separate field extraction for each group.

Re: How to find which group was matched in a regex when multiple groups are extracted to the same field?

woodcock — Fri, 07 Jul 2017 21:20:18 GMT

How and where are you doing this? Is it search-time with SPL or is it index-time with configuration files? Show us your "code".

Re: How to find which group was matched in a regex when multiple groups are extracted to the same field?

DalJeanis — Sat, 08 Jul 2017 20:50:37 GMT

I'm dubious about your statement that you had to. It sounds like you chose to, and then you found that your choice has caused a problem you didn't anticipate.

In essence, you are probably going to have to query the field to figure out what's in it, which would be more intuitive if you just extracted it into separate fields with the similar data named similarly and the different data named differently for each potential format.

Re: How to find which group was matched in a regex when multiple groups are extracted to the same field?

dwaddle — Sun, 09 Jul 2017 18:54:27 GMT

You really can't. Splunk does not expose how things were matched. Now, for debugging purposes, if you want to be freakishly clever, you can do something like this:

(?<common_name>(?<unique1>a+))|(?<common_name>(?<unique2>b+))

Assuming Splunk has the regex library configured to allow for duplicate subpattern names in a single regex (and I assume they do, but don't know this for a fact), then you could extract the field named common_name either as "a+" or "b+" -- but in the "a+" case we would also extract "unique1", and in the "b+" case we would also extract "unique2". This is taking advantage of some oddities of the regex engine.

Fun fact: This is also a semi-reasonable approach to replacing some instances of FIELDALIAS and some edge cases for EVAL