Splunk Search

Adding a fieldname to a regex extraction

agodoy
Communicator

I have this regex (https?:\/\/)?(www)?(.)?([a-z\d-]{2,})?(.)?([a-z\d-]{2,})?(.)?([a-z\d-]{2,})?.[a-z]{2,4} that I want to use to extract a new field.

How do I incorporate a field name to that regex to use in field extraction.
Thanks!

Tags (3)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

you need to define a special group with (?< fieldname >regexmatch)

read the documentation for examples :
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Rex

View solution in original post

Rob
Splunk Employee
Splunk Employee

Quite possibly, I would say that you may want to try doing some atomic grouping. In other words, for all the grouped up stuff in parentheses, like this:

(https?)...

Change it to;

(?:https?)

0 Karma

agodoy
Communicator

Thank you both.

So I changed my search to:

(?<name>(https?:\/\/)?(www)?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?\.[a-z]{2,4})

It works when I do a ... | rex "(?<name>(https?:\/\/)?(www)?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?\.[a-z]{2,4})" | top 50 name.

However, if I try to save a field extraction with that same regex I get an error"Encountered the following error while trying to update: In handler 'props-extract': Regex: syntax error in subpattern name (missing terminator)". It might be because of my dirty regex.

Thanks

0 Karma

Rob
Splunk Employee
Splunk Employee

Hi agodoy,

To extract fields using the Splunk search language, you will want to use the rex command. This is in the syntax of:

|rex field=myFieldName "myRegex(?regexToMatchValueForMyNewField)anyOtherRegex"

More info can be found in the docs.

Looking at your regex, you may want to clean up the regex a little.

0 Karma

Rob
Splunk Employee
Splunk Employee

Thank you sir! Nice job to you as well!

0 Karma

yannK
Splunk Employee
Splunk Employee

nice job mister

0 Karma

yannK
Splunk Employee
Splunk Employee

you need to define a special group with (?< fieldname >regexmatch)

read the documentation for examples :
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Rex

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...