topic Re: How to generate a regular expression that extracts a field in my event data? in Splunk Search

How to generate a regular expression that extracts a field in my event data?

jeck11 — Fri, 24 Feb 2017 14:39:43 GMT

I need to do a field extraction for everything after the ) to the end of the first line. I've tried about every regex I can think of to signify EOL but nothing seems to work so far.

Here is an event sample:
2017-02-22T18:01:04 | Creating request for https://0.0.0.0/images/logo.gif (msecure.company.com) Mobile US Site1 VIP
2017-02-22T18:01:04 | Information SSL1399 - The certificate is valid.; Data: Mobile US Site1 VIP; URL: https://0.0.0.0/images/logo.gif; Domain: msecure.company.com; Expiration: 08/10/2018 08:00:00

So for this event I would want this field to be "Mobile US Site1 VIP".

I'm sure I'm messing something up. Thanks in advanced!

Re: How to generate a regular expression that extracts a field in my event data?

horsefez — Fri, 24 Feb 2017 18:03:46 GMT

Is this what you are trying to do?

(?:^)(?:[^\)]+\)\s)(.+)

Re: How to generate a regular expression that extracts a field in my event data?

jeck11 — Fri, 24 Feb 2017 18:14:51 GMT

Your regex doesn't appear to select anything when I try it.

Here is the regex that Splunk gives me when I try and do it through the wizard:

^[^\)\n]*\)\s+(?P<description>\w+\s+\w+\s+\w+\s+\w+)

This will select anything up to a special character but the final field could have a dash ("-") in it and I can't control how long it is either.

Re: How to generate a regular expression that extracts a field in my event data?

pkeller — Fri, 24 Feb 2017 18:48:55 GMT

This seems to work at: https://www.regex101.com/

^.[^)]+)\s+(?P.+)

Re: How to generate a regular expression that extracts a field in my event data?

jrballesteros05 — Fri, 24 Feb 2017 19:34:02 GMT

This one seems to work for me:

 .*?\)\s+(?P<description>.*)

Re: How to generate a regular expression that extracts a field in my event data?

jeck11 — Fri, 24 Feb 2017 19:45:10 GMT

Yeah. That's what I came up with when using an external site like https://www.regex101.com/. Unfortunately, when I try that in Splunk it begins at the correct spot but goes all the way to the end of the last line instead of stopping at the end of line 1.

Re: How to generate a regular expression that extracts a field in my event data?

jrballesteros05 — Fri, 24 Feb 2017 19:51:30 GMT

Hi, sorry if I misunderstood.

Is that a multiline event? If so, you should use this one:

.*?\)\s+(?P<description>.*?)\n

Re: How to generate a regular expression that extracts a field in my event data?

pkeller — Fri, 24 Feb 2017 19:52:14 GMT

So your example is a multi-line event? .... This might work: ^.[^)]+)\s+(?P.+)\n?

Re: How to generate a regular expression that extracts a field in my event data?

jeck11 — Fri, 24 Feb 2017 19:55:34 GMT

YES! That did it. Thanks!

Re: How to generate a regular expression that extracts a field in my event data?

somesoni2 — Fri, 24 Feb 2017 21:09:28 GMT

@Jeck11, glad @jrballesteros05's answer provided a working solution to your question? Please don't forget to resolve this post by clicking "Accept".