topic Re: Stuck on extracting fields using own RegEx in Splunk Search

Stuck on extracting fields using own RegEx

StuReeves — Tue, 11 Apr 2017 12:02:07 GMT

Hi, still finding my around Spplunk and I've sort of go what I want in pt2 of my requirements, but after a couple of days, I'm just going around in a spin.

I'm trying to split up the raw data from an Avaya CM. I've go it coming in, managed to break each entry into a single line but then I get stumped trying to break it up further using the Extract Fields. I presume I need to ad this to either props or transforms, but at a loss what I need to enter.

The Avaya data comes in a fixed format such as:

and so on.

Using rex101 I created the expression

^(.{6})\s(.{4})\s(.{5})\s(.{1})\s(.{4})\s(.{4})\s(.{18})\s(.{15})\s(.{4})\s(.{7})\s(.{3})\s(.{3})\s(.{11})\s(.{5})\s(.{15})\s(.{2})\s(.{6})

which seems to work pefectly in the test.

However I'm at a complete loss as where to go next so that each field is split up and named. I've always used the Field Extraction tool, but it's the 1st time I've tried using my own, as opposed to standard delimiters.
All that I get is a tick next to my values, but can't do anything from there.
Sure it's something pretty simple, but I'm just stumped.
Thanks once again
Stu..

Re: Stuck on extracting fields using own RegEx

niketn — Tue, 11 Apr 2017 12:15:52 GMT

@StuReevs... Since you have not attached mock data in the question... I would expect the following to work. You seem to be missing names for extracted fields, Please test yourself in regex101 first. You can also test the same in Splunk using rex SPL command. Please change the field names from field1 thru field17 to something meaningful based on what you need.

^(?<field1>.{6})\s(?<field2>.{4})\s(?<field3>.{5})\s(?<field4>.{1})\s(?<field5>.{4})\s(?<field6>.{4})\s(?<field7>.{18})\s(?<field8>.{15})\s(?<field9>.{4})\s(?<field10>.{7})\s(?<field11>.{3})\s(?<field12>.{3})\s(?<field13>.{11})\s(?<field14>.{5})\s(?<field15>.{15})\s(?<field16>.{2})\s(?<field17>.{6})

Re: Stuck on extracting fields using own RegEx

StuReeves — Tue, 11 Apr 2017 12:26:47 GMT

Thats done the trick. I knew it was something fairly simple I was missing.

Re: Stuck on extracting fields using own RegEx

niketn — Tue, 11 Apr 2017 12:29:08 GMT

@StuReeves... Happens to all of us... all the time! Glad it worked 🙂