Splunk Search

Can you help me with the following regex expression?

zacksoft
Contributor

I have events from which I need to extract the strings that fall before the string "raced to road"

Here is a sample event:

'com.pyxis.greengoblin.phutan' - 'PhutanAgile'  raced to road.
            Error creating bean with name 'sampleDataGeneratorImpl' defined in URL [bundle://187.0:1/com/bsassian/greengoblin/sampledata/SampleDataGeneratorImpl.class]:
It was loaded from /bsahare/bsaassian/application-data/jirabiz/plugins/installed-plugins/plugin.8763102878749631573.loovytuner-5.5.28.jar    
        'com.bsa.phutan.plugins.bsa-development-integration-blogin' - 'Bsassian Phutan - blogins - Development Integration blogin'  raced to road.

The Strings that need to be extracted in the above sample events are 'PhutanAgile' and 'Bsassian Phutan - blogins - Development Integration blogin'

Tags (2)
0 Karma
1 Solution

493669
Super Champion

Hi @zacksoft,
Try this:

|rex max_match=0 "(?<a>[^']+)\'\s*raced to road"

View solution in original post

ddrillic
Ultra Champion

The simplistic (.*)raced to road. extracts it ; - )

0 Karma

493669
Super Champion

Hi @zacksoft,
Try this:

|rex max_match=0 "(?<a>[^']+)\'\s*raced to road"

zacksoft
Contributor

@493669 Thanks for the help. Where is the extracted string getting stored. I need to use the extracted string in a table command.

0 Karma

493669
Super Champion

field is extracted in fieldname a you can change as per your need to show it in table

0 Karma

Azeemering
Builder

Something like this?

.+?(?=raced to road)

https://regex101.com/r/0A66nK/1

0 Karma

FrankVl
Ultra Champion

Almost, but he doesn't want the entire string, just the bit in between ' right in front of "raced to road".

So it should be: [^\']+?(?=\'\s+raced to road)
https://regex101.com/r/0A66nK/2

But the solution presented by @493669 seems to be a lot more efficient (factor 30 in steps reported by regex101).

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...