Splunk Search

Distinguish between space and tab - REGEX

emaccaferri
Communicator

Hi!

I'm trying to build a regex to extract n-field in a log. Each field of the log is separated by a tab, but it's possible to find spaces (any kind of string or phrases) inside them, here an example

aaaaa, AD.cr(tab)2000-01-01 00:00:00(tab)12345/678-9(tab)987,654:321(tab)1(tab)2(tab)abcdefg123; asdoi(tab)...

There's a way to distinguish between a tab and a space or \s comprehend also tabs?
Supposing to need 6th field, this doesn't work

([a-zA-Z0-9,/:.-;=]+\s?\t){6}(?<field>[\w-:\s]+)\t

So

`aaaaa, AD.cr` 

or

abcdefg123; asdoi

have to be two field.
Actually I have more than 100 field and I would like to extract 64th.

Thank you

Tags (3)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

If you are certain there are no other tabs in the data, you can use a props/transforms to parse without regex.

props.conf
[my_sourcetype]
REPORT-do = extract_csv_fields_sourcetype

transforms.conf
[extract_csv_fields_sourcetype]
DELIMS = "\t"
FIELDS = field1, field2, field3, ... field100

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf
http://docs.splunk.com/Documentation/Splunk/latest/admin/transformsconf

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

If you are certain there are no other tabs in the data, you can use a props/transforms to parse without regex.

props.conf
[my_sourcetype]
REPORT-do = extract_csv_fields_sourcetype

transforms.conf
[extract_csv_fields_sourcetype]
DELIMS = "\t"
FIELDS = field1, field2, field3, ... field100

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf
http://docs.splunk.com/Documentation/Splunk/latest/admin/transformsconf

alacercogitatus
SplunkTrust
SplunkTrust

You can just put the first 64 in the FIELDS section, it should still pick them up correctly. But it won't really slow it down noticeably by extracting 64 fields. I have many many more fields than that and it works great. I think it's more expensive to use a regex than the FIELDS modifier.

0 Karma

emaccaferri
Communicator

If I use this method I have to extract all the 100 fields, even if I don't nedd them, right?
It would be not so efficient

0 Karma

Ayn
Legend

\s matches whitespace, which includes both regular spaces and tabs.

Ayn
Legend

Sure. '\t' for tab, and simply ' ' for space.

0 Karma

emaccaferri
Communicator

Ok thanks, there is a way to match only one of the two?

0 Karma

emaccaferri
Communicator

Usually in the line some field are empty, this means that there are a lot of tab one after the other

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!