Completely Newbie to REGEX

[sarnagar]

I'm completely new to REGEX. Started off learning by going through some videos and splunk docs.
Can someone please provide further resource to get hands-on on these REGEXs.
1) When I use the regex developed from Splunk Field extractor in my props config it doesnt seem to work . What is that I need to tweak after I get the REGEX from Splunk?? If I'm not wrong splunk captures from the starting of the line instead of field-value pair.

2) I have events like below. I want three different REGEX extracting the fields as highlighted below: I tried quite a few but in vain. Can someone please help in configuring the 3 different REGEX for these 3 fields:

{"line":"[ERROR ] CWWKG0031E: The value jdbc/actionateDB specified for unique attribute jndiName is already in use.","source":"stderr","tag":"itec-artifactory.dis.com:6555/com.dis.pl000123.demo.actionate:0.0.1-25/Actionate_DEV_ACTIONATE.1.5tv4m4ckohx526muwvkcyo0v6/a078f70a8338"}
{"line":"[WARNING ] CWWKG0076W: The previous configuration for jndiReferenceEntry with id customDataSourceFactoryEntry is still in use.","source":"stdout","tag":"itec-artifactory.dis.com:6555/com.dis.pl000123.demo.actionate:0.0.1-25/Actionate_DEV_ACTIONATE.1.5tv4m4ckohx526muwvkcyo0v6/a078f70a8338"}
{"line":"","source":"stdout","tag":"itec-artifactory.dis.com:6555/com.dis.pl000123.demo.actionate:0.0.1-25/Actionate_DEV_ACTIONATE.1.5tv4m4ckohx526muwvkcyo0v6/a078f70a8338"}
{"line":"++ dirname /config/configDropins/defaults/keystore.xml","source":"stderr","tag":"itec-artifactory.dis.com:6555/com.dis.pl000123.demo.actionate:0.0.1-25/Actionate_DEV_ACTIONATE.1.5tv4m4ckohx526muwvkcyo0v6/a078f70a8338"}

I want to extract 3 fields from the above italicised line like below:
image=itec-artifactory.dis.com:6555/com.dis.pl000123.demo.actionate:0.0.1-25, service=Actionate_DEV_ACTIONATE.1.5tv4m4ckohx526muwvkcyo0v6,id=a078f70a8338

Greatly appreciate your help on this. Thankyou

[gcusello]

Hi sarnagar,
I'm not sure that this regex takes all your situations, every way it extract the field you asked.
Try this

\{\"([^\"]*\"){9}(?<image>.*)\/(?<service>Actionate[^\"]*)\/(?<id>.*)\"\}

see it at https://regex101.com/r/2mhZ25/1

Generally, you can test your regexes at https://regex101.com/

Bye.
Giuseppe

[gokadroid]

If the "tag" element is always having four parts, can you try this at search time or use the regex while extracting in field extractor:

yourBaseQuery
| rex "\"tag\"\:\"(?<image>([^\/]+\/){2})(?<service>[^\/]+)\/(?<id>[^\"]+)"
| complete your query

See resulting extraction here