Getting Data In

Splunkism Regex?

cdstealer
Contributor

When using PCRE regex to split a field into components, I find it frustrating.  I know my regex works as I've validated this in both regex101 and debuggex.

debuggex.jpg

 

(?:.*?)(?P<ClientIP>(?:\d{1,3}\.){3}\d{1,3}|(?:(?:[0-9a-f]{1,4}(?::+)?){0,7}:+[0-9a-f]+))[,\n\r]+(?:(?:[\+](?P<LB_IP>[^:](?:\d{1,3}\.){3}\d{1,3}):(?P<LB_Port>\d+)))?

 

So this is extracting details from the IIS X_Forwarded_For field.  The supplied log data that was parsed extracted perfectly on both platforms and even using "grep -P".  But in Splunk, I only get a full extraction when the following format is observed.

123.123.123.123,+123.123.123.123,+123.123.123.123:12345

If  the final ip:port is missing from the event, only the first IP is captured

123.123.123.123,+123.123.123.123

I've had similar experiences over the years with Splunk, so I'm wondering if my regex fu is rubbish, regex validators are wrong or splunk has a bug that's never been fixed.

TIA

Steve

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you posted the regex as text rather than an image then we could test it ourselves to better help you.

Where did you define the regex in Splunk (props.conf, transforms.conf, Add Data Wizard, etc.)?

---
If this reply helps you, Karma would be appreciated.
0 Karma

cdstealer
Contributor

Hi Richard,  The regex is defined in transforms and called by props.

Apologies, that would be useful 🙂 Added to the top

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In Splunk, the default behavior is to keep only the first match.  To accept multiple matches, use the REPEAT_MATCH or MV_ADD settings.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Which version of splunk are you using as this may be a factor too?

0 Karma

cdstealer
Contributor

We're running 8.1.3 currently.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...