Hi!
I'm trying to build a regex to extract n-field in a log. Each field of the log is separated by a tab, but it's possible to find spaces (any kind of string or phrases) inside them, here an example
aaaaa, AD.cr(tab)2000-01-01 00:00:00(tab)12345/678-9(tab)987,654:321(tab)1(tab)2(tab)abcdefg123; asdoi(tab)...
There's a way to distinguish between a tab and a space or \s
comprehend also tabs?
Supposing to need 6th field, this doesn't work
([a-zA-Z0-9,/:.-;=]+\s?\t){6}(?<field>[\w-:\s]+)\t
So
`aaaaa, AD.cr`
or
abcdefg123; asdoi
have to be two field.
Actually I have more than 100 field and I would like to extract 64th.
Thank you
If you are certain there are no other tabs in the data, you can use a props/transforms to parse without regex.
props.conf
[my_sourcetype]
REPORT-do = extract_csv_fields_sourcetype
transforms.conf
[extract_csv_fields_sourcetype]
DELIMS = "\t"
FIELDS = field1, field2, field3, ... field100
http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf
http://docs.splunk.com/Documentation/Splunk/latest/admin/transformsconf
If you are certain there are no other tabs in the data, you can use a props/transforms to parse without regex.
props.conf
[my_sourcetype]
REPORT-do = extract_csv_fields_sourcetype
transforms.conf
[extract_csv_fields_sourcetype]
DELIMS = "\t"
FIELDS = field1, field2, field3, ... field100
http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf
http://docs.splunk.com/Documentation/Splunk/latest/admin/transformsconf
You can just put the first 64 in the FIELDS section, it should still pick them up correctly. But it won't really slow it down noticeably by extracting 64 fields. I have many many more fields than that and it works great. I think it's more expensive to use a regex than the FIELDS modifier.
If I use this method I have to extract all the 100 fields, even if I don't nedd them, right?
It would be not so efficient
\s
matches whitespace, which includes both regular spaces and tabs.
Sure. '\t
' for tab, and simply ' '
for space.
Ok thanks, there is a way to match only one of the two?
Usually in the line some field are empty, this means that there are a lot of tab one after the other