Other Usage

Regex works with in regex101 but not in Splunk

lbrhyne
Path Finder

The following expression works in regex101: https://regex101.com/r/4D68Ip/1
But not in Splunk. Any help would be appreciated

 

(?i)nTimeframe\s+\(\w+\)\s+\w+\s+\w+\s+\%\s+\w+\\\w+\\\w+\\\w+\\\w\d+\:\d+\-\d+\:\d+\\\w+\\\w+\\\w+\\\w(?P<Successful>\d+)

 

We are attempting to extract 58570 from the below string.

TEST STING

 

run.\r\nTimeframe (PT)  Success Failed  % Failed\r\n\r\n05:15-06:14\r\n\r\n58570\r\n\r\n681\r\n\r\n1.15\r\n\r\nIf you believe you've received this email in error, please see your Splunk"}

 

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @lbrhyne,

there's an issue in field extraction in Splunk when you have in your logs one or more backslashes, in my opinion it's a bug and I discussed with Support specialists about this.

In this case use (trying) three or four backslashes instead of two as in regex101.

You must use this workaround if you use the rex command in a search.

If instead you want to use the regex for a field extraction not in a search, you have to use the regex that works in regex101.

ciao.

Giuseppe

View solution in original post

lbrhyne
Path Finder

I thought I would pop in and let you all know the resolution from Splunk.

:\d{2}\s+(?P<Successful>\d+)\s+(?P<Failed>\d+)\s+(?P<Percentage>\S+) IN bodyPreview

 

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @lbrhyne 

You can do one simple idea - just search for a 5 digit numbers in your logs(Pls check the logs and see if there are any other 5 digit numbers)

| makeresults | eval log="run.\r\nTimeframe (PT)  Success Failed  % Failed\r\n\r\n05:15-06:14\r\n\r\n58570\r\n\r\n681\r\n\r\n1.15\r\n\r\nIf you believe you've received this email in error, please see your Splunk\"}" 
| rex field=log (?P<Successful>\d{5}) | table log Successful

rex-5-digits.jpg

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

gcusello
SplunkTrust
SplunkTrust

Hi @lbrhyne,

there's an issue in field extraction in Splunk when you have in your logs one or more backslashes, in my opinion it's a bug and I discussed with Support specialists about this.

In this case use (trying) three or four backslashes instead of two as in regex101.

You must use this workaround if you use the rex command in a search.

If instead you want to use the regex for a field extraction not in a search, you have to use the regex that works in regex101.

ciao.

Giuseppe

lbrhyne
Path Finder

@gcusello Thank You! Your solution worked, partly. At search time this worked perfectly: 

Using - nTimeframe\s+\(\w+\)\s+\w+\s+\w+\s+\%\s+\w+\\\\\w+\\\\\w+\\\\\w+\\\\\w\d+\:\d+\-\d+\:\d+\\\\\w+\\\\\w+\\\\\w+\\\\\w(?P<Successful>\d+)



However, neither the regex above or the following worked as a field extract: 

Regex101 - nTimeframe\s+\(\w+\)\s+\w+\s+\w+\s+\%\s+\w+\\\w+\\\w+\\\w+\\\w\d+\:\d+\-\d+\:\d+\\\w+\\\w+\\\w+\\\w(?P<Successful>\d+)



I have opened up a ticket with Splunk to see  if they can figure it out. For now I will be using the search time extraction. If Splunk provides a solution, I will post an update.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @lbrhyne,

I also opened a case to Splunk Support and thay said that this behavior is all normal!

Please push also you so maybe they will understand!

I'm discussing with them because for me this is a bug, also because, if you create a field extraction, using the regex101 regex (it's the only one that runs in field extractions!) and then you try to use the IFX, you'll have a red error!

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...