Another Regex Question

[kwkeefer]

I'm trying to rex out a new field from the message.Exception field. What I'm trying to extract is in the brackets below (the brackets are not actually in the Splunk message):

com.companyname.companyinitials.[servicename.servicenameApplication].main

I need to make it so that the regex looks for something that starts with "com.companyname.companyinitials." and ends with ".main" as the message.Exceptions field also contains something that starts with "com.companyname.companyinitials." but it is unrelated to the field I'm trying to extract.

I've tried to hack together some regex based on my google searching (I'm decent at regex for python but I can't figure out Splunk's for some reason) and I'm not doing very well. Here's what I have so far (which isn't working obviously):

...query... | rex field=message.Exception "com\.companyname\.companyinitials\.(?<Service>[^(main)]"

I'm getting a new field, but it only contains one character, and it seems to be the character for the other unrelated line that starts with the same "com.companyname.companyinitials." ...

I appreciate any help - sorry for being bad at regex..

[gokadroid · Accepted solution]

How about trying this to save the required text in field requiredText

...query... | rex field=message.Exception "com\.companyname\.companyinitials\.(?<requiredText>[\S]+)\.main"

See extraction here

[mayurr98]

hey Try this run anywhere search

| makeresults 
| eval message.Exception="com.companyname.companyinitials.servicename.servicenameApplication.main" 
| rex field="message.Exception" "com\.companyname\.companyinitials\.(?<Service>.*)\.main"

In your environment, you should write

...query... | rex field=message.Exception "message.Exception" "com\.companyname\.companyinitials\.(?<Service>.*)\.main"

let me know if this helps!

[493669]

Try this:

|rex field="message.Exception"  "com\.companyname\.companyinitials\.(?<serviceName>\w+\.\w+)\.main"

[gokadroid]

This regex has the flaw that if there are more than two elements in the requirement stated in question and I quote I need to make it so that the regex looks for something that starts with "com.companyname.companyinitials." and ends with ".main" as the message this will fail for sure.
It will fail for something like this with three elements between com.companyname.companyinitials and .main:

com.companyname.companyinitials.servicename.servicenameApplication.abc.main

[adonio]

hope i understood you correctly,
give this a try:

 ... search ... | rex field="message.Exception" "com\.companyname\.companyinitials.\[(?<serviceName>\w+)\.(?<serviceNameAplication>\w+)]\.main"

extracting two fields: serviceName and serviceNameApllication
if you want one field:

 ... search ... | rex field="message.Exception" "com\.companyname\.companyinitials.\[(?<serviceName>\w+\.\w+)]\.main"

hope it helps