Getting Data In
Highlighted

Regular expression in props.conf

Builder

I have an output

lifesize_cdr: INFO 24,16,8CC 9-107-Photon,172.20.129.30,,,,2012-02-07 16:22:21,2012-02-07 16:22:21,00:00:00,In,PSTN,None,0,0,,,,,,,No,No,None,Normal,0.000,0.000,0,0,0.000,0.000,0,0,0.000,0.000,0,0,0.000,0.000,0,0,0.000,0.000,0,0,0.000,0.000,0,1295,vtc-9-108-Tachyon.8cc

I have matched 1295 by this in props.conf

EXTRACT-lsCDR_lifesize_name= (?i)lifesize_cdr: INFO \d+,\d+(,.*?){46},(?P<lsCDR_lifesize_name>.*?),

but for vtc-9-108-Tachyon.8cc both (below) are not matching

EXTRACT-lsCDR_lifesize_name2= (?i)lifesize_cdr: INFO \d+,\d+(,.*?){47},(?P<lsCDR_lifesize_name2>.*?),

or

EXTRACT-lsCDR_lifesize_name3= (?i)lifesize_cdr: INFO \d+,\d+(,.*?){47},(?P<lsCDR_lifesize_name3>)

can you make this ?

Tags (1)
0 Karma
Highlighted

Re: Regular expression in props.conf

Splunk Employee
Splunk Employee

How about this?

EXTRACT-lsCDR_lifesize_name = lifesize_cdr:\s+INFO\s+.+,(?<lscdr_lifesize_name>[\w\.\-]+)$

View solution in original post

Highlighted

Re: Regular expression in props.conf

Builder

Still This is not working with this reg ex as above

0 Karma
Highlighted

Re: Regular expression in props.conf

Legend

I fixed the formatting so that backslash characters weren't improperly interpreted. Does the regex work better now?

0 Karma
Highlighted

Re: Regular expression in props.conf

Builder

Thanks Its working now...

0 Karma
Highlighted

Re: Regular expression in props.conf

Splunk Employee
Splunk Employee

Thanks, Ayn!

0 Karma