All Apps and Add-ons

conditional rex in field extraction

yunusemreakbaba
Engager
2108 2013-03-08 15:47:58.802912 10.240.97.64 -> 10.240.97.99 TCP 74 53224 > 22 [FIN, SYN, PSH, URG] Seq=0 Win=256 Urg=0 Len=0 WS=1024 MSS=265 TSval=4294967295 TSecr=0 SACK_PERM=1
2106 2013-03-08 15:47:58.752178 10.240.97.64 -> 10.240.97.99 UDP 342 Source port: 53196  Destination port: 33997
2089 2013-03-08 15:47:58.342168 10.240.97.64 -> 10.240.97.99 ICMP 192 Echo (ping) request  id=0x11da, seq=296/10241, ttl=38

I have multiple lines in different formats as seen above, and my log formats are diversed due to the protocols(TCP, UDP, ICMP, ARP, SSL). Is is possible to write a conditional regex like:

use this regex if it contains 'TCP'

and use this regex if contains 'UDP'

...
?

Any help is appreciated.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could write two regular expressions, each containing TCP or UDP - then each expression will only match their respective event type. Alternatively, write one expression with the two in parenthesis and separated by a pipe.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could write two regular expressions, each containing TCP or UDP - then each expression will only match their respective event type. Alternatively, write one expression with the two in parenthesis and separated by a pipe.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...