Getting Data In

Regular expression in props.conf

kml_uvce
Builder

I have an output

lifesize_cdr: INFO 24,16,8CC 9-107-Photon,172.20.129.30,,,,2012-02-07 16:22:21,2012-02-07 16:22:21,00:00:00,In,PSTN,None,0,0,,,,,,,No,No,None,Normal,0.000,0.000,0,0,0.000,0.000,0,0,0.000,0.000,0,0,0.000,0.000,0,0,0.000,0.000,0,0,0.000,0.000,0,1295,vtc-9-108-Tachyon.8cc

I have matched 1295 by this in props.conf

EXTRACT-lsCDR_lifesize_name= (?i)lifesize_cdr: INFO \d+,\d+(,.*?){46},(?P<lsCDR_lifesize_name>.*?),

but for vtc-9-108-Tachyon.8cc both (below) are not matching

EXTRACT-lsCDR_lifesize_name2= (?i)lifesize_cdr: INFO \d+,\d+(,.*?){47},(?P<lsCDR_lifesize_name2>.*?),

or

EXTRACT-lsCDR_lifesize_name3= (?i)lifesize_cdr: INFO \d+,\d+(,.*?){47},(?P<lsCDR_lifesize_name3>)

can you make this ?

kamal singh bisht
Tags (1)
0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

How about this?

EXTRACT-lsCDR_lifesize_name = lifesize_cdr:\s+INFO\s+.+,(?<lscdr_lifesize_name>[\w\.\-]+)$

View solution in original post

Masa
Splunk Employee
Splunk Employee

How about this?

EXTRACT-lsCDR_lifesize_name = lifesize_cdr:\s+INFO\s+.+,(?<lscdr_lifesize_name>[\w\.\-]+)$

Masa
Splunk Employee
Splunk Employee

Thanks, Ayn!

0 Karma

kml_uvce
Builder

Thanks Its working now...

kamal singh bisht
0 Karma

Ayn
Legend

I fixed the formatting so that backslash characters weren't improperly interpreted. Does the regex work better now?

0 Karma

kml_uvce
Builder

Still This is not working with this reg ex as above

kamal singh bisht
0 Karma
Get Updates on the Splunk Community!

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...