Splunk Search

Another Regex Question

kwkeefer
Explorer

I'm trying to rex out a new field from the message.Exception field. What I'm trying to extract is in the brackets below (the brackets are not actually in the Splunk message):

com.companyname.companyinitials.[servicename.servicenameApplication].main

I need to make it so that the regex looks for something that starts with "com.companyname.companyinitials." and ends with ".main" as the message.Exceptions field also contains something that starts with "com.companyname.companyinitials." but it is unrelated to the field I'm trying to extract.

I've tried to hack together some regex based on my google searching (I'm decent at regex for python but I can't figure out Splunk's for some reason) and I'm not doing very well. Here's what I have so far (which isn't working obviously):

...query... | rex field=message.Exception "com\.companyname\.companyinitials\.(?<Service>[^(main)]"

I'm getting a new field, but it only contains one character, and it seems to be the character for the other unrelated line that starts with the same "com.companyname.companyinitials." ...

I appreciate any help - sorry for being bad at regex..

0 Karma
1 Solution

gokadroid
Motivator

How about trying this to save the required text in field requiredText

...query... | rex field=message.Exception "com\.companyname\.companyinitials\.(?<requiredText>[\S]+)\.main"

See extraction here

View solution in original post

gokadroid
Motivator

How about trying this to save the required text in field requiredText

...query... | rex field=message.Exception "com\.companyname\.companyinitials\.(?<requiredText>[\S]+)\.main"

See extraction here

mayurr98
Super Champion

hey Try this run anywhere search

| makeresults 
| eval message.Exception="com.companyname.companyinitials.servicename.servicenameApplication.main" 
| rex field="message.Exception" "com\.companyname\.companyinitials\.(?<Service>.*)\.main"

In your environment, you should write

...query... | rex field=message.Exception "message.Exception" "com\.companyname\.companyinitials\.(?<Service>.*)\.main"

let me know if this helps!

0 Karma

493669
Super Champion

Try this:

|rex field="message.Exception"  "com\.companyname\.companyinitials\.(?<serviceName>\w+\.\w+)\.main"

gokadroid
Motivator

This regex has the flaw that if there are more than two elements in the requirement stated in question and I quote I need to make it so that the regex looks for something that starts with "com.companyname.companyinitials." and ends with ".main" as the message this will fail for sure.
It will fail for something like this with three elements between com.companyname.companyinitials and .main:

com.companyname.companyinitials.servicename.servicenameApplication.abc.main

0 Karma

adonio
Ultra Champion

hope i understood you correctly,
give this a try:

 ... search ... | rex field="message.Exception" "com\.companyname\.companyinitials.\[(?<serviceName>\w+)\.(?<serviceNameAplication>\w+)]\.main"

extracting two fields: serviceName and serviceNameApllication
if you want one field:

 ... search ... | rex field="message.Exception" "com\.companyname\.companyinitials.\[(?<serviceName>\w+\.\w+)]\.main"

hope it helps

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! &#x1f44f; Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...