Hi,
I'm struggling to confirm in the docs whether this is permitted or not? I'm working on a TA for Netgear Wi-Fi, the log format is not brilliant to work with but I want to extract the ssid (Wi-Fi) network name. There are two formats of log containing this. I have written:
Wi-Fi/default/props.conf EVAL-src_mac = bssid
Wi-Fi/default/props.conf EXTRACT-bssid = \"bssid\"\:\"(?<bssid>\w+\-\w+\w+\-\w+\-\w+\-\w+\-\w+)"
Wi-Fi/default/props.conf EXTRACT-ssid = \"ssid\"\:\"(?<ssid>.*?)"
Wi-FI/default/props.conf EXTRACT-wifi_join_leave_ssid = (disconnected\sfrom\s|connected\sto\s)(?<ssid>.+?)(?: with an RSSI|}$)
Both these extractions appear to work just fine at search time which really surprised me, I was obsessing over trying to combine a long REGEX with an OR. I've obviously referred to:
https://docs.splunk.com/Documentation/Splunk/9.1.1/Admin/Propsconf
Which makes it clear that the CLASS must be unique (no problem) but the capture group name gets no mention?
Why do you escape the quotes? You don't need to do that.
Hi @richgalloway I think this is the point. What we're saying / agreeing is that there is no requirement for a unique 'capture group name' effectively the two regex field values 'coalesce' and quite tidily in the instance that I have tested. This is a surprise and was not at all clear and actually lends flexibility.
hi @richgalloway , thanks for replying. Let me be clearer, I am extracting SSID twice using the named capture group in both instances is 'SSID' per btool.
What has surprised me and I can't see listed is the requirement for a Unique capturing group name.
The highlighted text in my screen shot shows where the Admin manual says a capturing group is required in EXTRACT. It does not say the group name must be unique because that is not a requirement. Although a given regex may fail if the same group name is used more than once, the same group name may be used in multiple EXTRACT settings.
The capture group name is indeed mentioned.