Splunk Enterprise

Multivalue Field extaction using Regular Expressions

perrinj2
Path Finder

I'm trying to extract fields from the following event data

[Scenario_summary]
Scenario Type=Manual Scenario
Goal Profile Name=Schedule 1
Mode=Scenario Scheduling
Scenario Duration=Start 27 Vusers: 1 every 00:00:15 (HH:MM:SS); Run for 00:30:00 (HH:MM:SS); Stop all Vusers simultaneously
Load Behavior=Initialize each Vuser just before it runs

[Scripts]
apache_on_5154=D:\LoadRunner Repo\LoadRunner\Loadrunner Scripts\apache_on_5154\apache_on_5154.usr
AjaxClickAndScript1=D:\LoadRunner Scripts\SPLUNK_SOLUTION_2\AjaxClickAndScript1\AjaxClickAndScript1.usr
AddNewCustomer=D:\CPE_Demo\AddNewCustomer\AddNewCustomer.usr

[Scripts_types]
apache_on_5154=Multi+QTWeb
AjaxClickAndScript1=WebAjax
AddNewCustomer=Multi+QTWeb

 

Specifically I want to extract the LoadRunner group names and protocols below the [Scripts_types] which can be 1 to n depending on the Scenerio.  In this example the script names would be

apache_on_5154
AjaxClickAndScript1
AddNewCustomer

I've tried a regular expression with a named group to extract the fields. eg

\[Scripts_types\]\n(?<Group1>.+)=.+
\[Scripts_types\]\n(?:.+)=.+\n(?<Group2>.+)=.+\n(?:.+)=.+
\[Scripts_types\]\n(?:.+)=.+\n(?:.+)=.+\n(?<Group3>.+)=.+

But that gives me 3 different named fields and does not cater for case where there are more of less of these lines in the event. 

If I use a repeating group like

\[Scripts_types\](\n(?<GroupName>.+)=.+)+

It only captures the last iteration ie "AddNewCustomer" 

Anyone know how to deal with this? 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Having got a single field, can you not run a further regex on that to get just the data you require?

View solution in original post

perrinj2
Path Finder

Further to this  the following regex 

\[Scripts_types\](?<Scripts_types>(?:\n(?:.+)=.+)+)

will extract a single named group with value

apache_on_5154=Multi+QTWeb AjaxClickAndScript1=WebAjax AddNewCustomer=Multi+QTWeb

which I think is the only regex that makes sense in this situation.

So I'll look at how to extract the required fields from the field values. Any tips on this approach appreciated.

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Having got a single field, can you not run a further regex on that to get just the data you require?

perrinj2
Path Finder

@ITWhisperer  Thanks, that's what I thought might be the next step. I was hoping to do it in one pass but that doesn't seem possible. 

0 Karma

perrinj2
Path Finder

It's one event

0 Karma

thambisetty
SplunkTrust
SplunkTrust

is below only one event ? if yes, please don't format the event before sharing it in community especially the question is about regular expression, we can't give proper answer if the event is modified and shared here.

 

[Scenario_summary]
Scenario Type=Manual Scenario
Goal Profile Name=Schedule 1
Mode=Scenario Scheduling
Scenario Duration=Start 27 Vusers: 1 every 00:00:15 (HH:MM:SS); Run for 00:30:00 (HH:MM:SS); Stop all Vusers simultaneously
Load Behavior=Initialize each Vuser just before it runs

[Scripts]
apache_on_5154=D:\LoadRunner Repo\LoadRunner\Loadrunner Scripts\apache_on_5154\apache_on_5154.usr
AjaxClickAndScript1=D:\LoadRunner Scripts\SPLUNK_SOLUTION_2\AjaxClickAndScript1\AjaxClickAndScript1.usr
AddNewCustomer=D:\CPE_Demo\AddNewCustomer\AddNewCustomer.usr

[Scripts_types]
apache_on_5154=Multi+QTWeb
AjaxClickAndScript1=WebAjax
AddNewCustomer=Multi+QTWeb

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...