Splunk Search

Can you help me create the regex that captures a string with a space in it?

jip31
Motivator

Hello

I have a field with a space in the string :

Model=WDC WD5000LPLX-60ZNTT1

But SPLUNK displays only the characters WDC because of the space.

I need a regex please which displays WDC WD5000LPLX-60ZNTT1 (so with the space) but that will be readable by Splunk.

Thanks!

Tags (2)
0 Karma
1 Solution

MathiasLindblom
Path Finder

If we assume that whatever comes after Model= is fixed, eg:

Model=WDC WD5000LPLX-60ZNTT1 Test=XYZ

You could use a lookahead to "Test" like this:

    Model=(?P<Model>.*(?!Test))\s

Hope this could help, otherwise it would help with the entire event as mentioned before.

View solution in original post

0 Karma

MathiasLindblom
Path Finder

If we assume that whatever comes after Model= is fixed, eg:

Model=WDC WD5000LPLX-60ZNTT1 Test=XYZ

You could use a lookahead to "Test" like this:

    Model=(?P<Model>.*(?!Test))\s

Hope this could help, otherwise it would help with the entire event as mentioned before.

0 Karma

jip31
Motivator

I done | rex field=Caption "(?P(?!Test))\s" but i have the message⚠ Error in 'rex' command: Encountered the following error while compiling the regex '(?P(?!Test))\s': Regex: unrecognized character after (?P

0 Karma

MathiasLindblom
Path Finder

If the event is on one line, you can use this:

| rex field=_raw "Model=(?P<Model>.*?)\sName"
0 Karma

jip31
Motivator

perfect thanks

0 Karma

MathiasLindblom
Path Finder

Hi,

seems like I lost a few characters when posting. If the event are as you described above, where they are all on each line, this regex should work:

| rex field=_raw "Model=(?P<Model>[^\n]*)"
0 Karma

woodcock
Esteemed Legend

we need to see the entire event (preferably several of them).

0 Karma

jip31
Motivator

here is an example of one event fields
20181121161210.530611
Caption=WDC WD5000LPLX-60ZNTT1
DeviceID=\.\PHYSICALDRIVE0
FirmwareRevision=02.01A02
Model=WDC WD5000LPLX-60ZNTT1
Name=\.\PHYSICALDRIVE0
Size=500105249280
Status=OK
wmi_type=DiskDrive

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>