Other Usage

Regex works with in regex101 but not in Splunk

lbrhyne
Path Finder

The following expression works in regex101: https://regex101.com/r/4D68Ip/1
But not in Splunk. Any help would be appreciated

 

(?i)nTimeframe\s+\(\w+\)\s+\w+\s+\w+\s+\%\s+\w+\\\w+\\\w+\\\w+\\\w\d+\:\d+\-\d+\:\d+\\\w+\\\w+\\\w+\\\w(?P<Successful>\d+)

 

We are attempting to extract 58570 from the below string.

TEST STING

 

run.\r\nTimeframe (PT)  Success Failed  % Failed\r\n\r\n05:15-06:14\r\n\r\n58570\r\n\r\n681\r\n\r\n1.15\r\n\r\nIf you believe you've received this email in error, please see your Splunk"}

 

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @lbrhyne,

there's an issue in field extraction in Splunk when you have in your logs one or more backslashes, in my opinion it's a bug and I discussed with Support specialists about this.

In this case use (trying) three or four backslashes instead of two as in regex101.

You must use this workaround if you use the rex command in a search.

If instead you want to use the regex for a field extraction not in a search, you have to use the regex that works in regex101.

ciao.

Giuseppe

View solution in original post

lbrhyne
Path Finder

I thought I would pop in and let you all know the resolution from Splunk.

:\d{2}\s+(?P<Successful>\d+)\s+(?P<Failed>\d+)\s+(?P<Percentage>\S+) IN bodyPreview

 

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @lbrhyne 

You can do one simple idea - just search for a 5 digit numbers in your logs(Pls check the logs and see if there are any other 5 digit numbers)

| makeresults | eval log="run.\r\nTimeframe (PT)  Success Failed  % Failed\r\n\r\n05:15-06:14\r\n\r\n58570\r\n\r\n681\r\n\r\n1.15\r\n\r\nIf you believe you've received this email in error, please see your Splunk\"}" 
| rex field=log (?P<Successful>\d{5}) | table log Successful

rex-5-digits.jpg

gcusello
SplunkTrust
SplunkTrust

Hi @lbrhyne,

there's an issue in field extraction in Splunk when you have in your logs one or more backslashes, in my opinion it's a bug and I discussed with Support specialists about this.

In this case use (trying) three or four backslashes instead of two as in regex101.

You must use this workaround if you use the rex command in a search.

If instead you want to use the regex for a field extraction not in a search, you have to use the regex that works in regex101.

ciao.

Giuseppe

lbrhyne
Path Finder

@gcusello Thank You! Your solution worked, partly. At search time this worked perfectly: 

Using - nTimeframe\s+\(\w+\)\s+\w+\s+\w+\s+\%\s+\w+\\\\\w+\\\\\w+\\\\\w+\\\\\w\d+\:\d+\-\d+\:\d+\\\\\w+\\\\\w+\\\\\w+\\\\\w(?P<Successful>\d+)



However, neither the regex above or the following worked as a field extract: 

Regex101 - nTimeframe\s+\(\w+\)\s+\w+\s+\w+\s+\%\s+\w+\\\w+\\\w+\\\w+\\\w\d+\:\d+\-\d+\:\d+\\\w+\\\w+\\\w+\\\w(?P<Successful>\d+)



I have opened up a ticket with Splunk to see  if they can figure it out. For now I will be using the search time extraction. If Splunk provides a solution, I will post an update.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @lbrhyne,

I also opened a case to Splunk Support and thay said that this behavior is all normal!

Please push also you so maybe they will understand!

I'm discussing with them because for me this is a bug, also because, if you create a field extraction, using the regex101 regex (it's the only one that runs in field extractions!) and then you try to use the IFX, you'll have a red error!

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...