Splunk Search

Can I match multiple patterns with regex in the same search to extract fields from logs?

sanchitguptaiit
Explorer

I have a requirement where I need to search all logs to match a set of patterns and extract some values. Is there something in Splunk to help with same?

For eg: below are various search patterns I would like to find in logs (and there are 100s of these). If there is any match, print the value matching a regex and the pattern that was matched.

Input Patterns:

Error in CUSIP ## *([A-Za-z0-9]{9})* (Wrong model model indicatives not found)
*([A-Za-z0-9]{9})* does not have up shift cashflow, pass
CUSIP ([A-Za-z0-9]{9}) is not in input file
ValueError: Missing cashflow for scenario opt cusip ([A-Za-z0-9]{9})
ssm_id ([A-Za-z0-9]{9}). has error:.. doSetYieldCurve:ERROR: :ERROR: Cannot get rates for intex
,([A-Za-z0-9]{9}),[0-9]+ loans out of [0-9]+ were using group/deal level curves

Output:

Value        |   pattern
123456789    |    ## Error in CUSIP ## 123456789 (Wrong model model indicatives not found)
1AB456789    |    ## Error in CUSIP ## 1AB456789 (Wrong model model indicatives not found)
123456789    |   123456789   does not have up shift cashflow, pass

thanks, Sanchit

0 Karma

woodcock
Esteemed Legend
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...