Splunk Search

Extract multiple fields with one RegEx

matthew_foos
Path Finder

Splunkers,

I'm trying to write one regex to extract a bunch of fields from a single event.

Here's an example of one event of some of the fields in one event:

avgtemp 50 hottemp 50 tempalert y tempflag y etc

I've tried using a pipe to separate the field extractions with no luck.

When I run the preview in the Splunk field extractor, I get no results. When I remove every capture group except the first one, it works just fine.

Any advice with the regex would be great.

Thanks

0 Karma

ryhluc01
Communicator

I think I would need some sample data but for the time being what comes before the regex can affect your results.

|regex Event_Sample="1st field|2nd field"

If you still could use an answer to this question just comment on this feed.

0 Karma

yannK
Splunk Employee
Splunk Employee

if your event is like

avgtemp 50 hottemp 50 tempalert y tempflag y etc

you can list each field : try

mysearch 
| rex "avgtemp (?<avgtemp>\d+) hottemp (?<hottemp>\d+) tempalert (?<tempalert)\w+) tempflag (?<tempflag>\d+)" " 
| table avgtemp hottemp tempalert tempflag

or you can use a field transforms and define the field name dynamically.
see transforms.conf

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms#Example_-_Extract...

example on disk on the search-head.
props.conf

[mysourcetype]
TRANSFORMS-myextraction=repeat_regex_space_separator

transforms.conf

 [repeat_regex_space_separator]
 REGEX = ([a-z])]\s(\d+)
 FORMAT = $1::$2
 REPEAT_MATCH = true
0 Karma

AnilPujar
Path Finder

What if this sequence is not in order:

avgtemp 50 hottemp 50 tempalert y tempflag y etc

avgtemp 50 tempalert y tempflag y etc hottemp 50

?

0 Karma

matthew_foos
Path Finder

I'm trying to do this in the field extractor.

SourceSystem\s(?P\w+)(.*?)TargetSystem\s(?P\w+)

Would the (.*?) work?

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Please provide a good set of example data (anonymized, but valid - only anonymize, don't change anything otherwise) that you also use the 101010 button on to make it be formatted correctly and it doesn't remove any characters) along with your non-working regular expression (again using the 101010 button for formatting). That will help tremendously in helping you.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...