Splunk Search

Extracting two types of fields in a query (IFX)

Explorer

I have my xml data HERE, I need to extract using Splunk IFX, Generated pattern (regex).

Example Xml: (22/7)17:53 Accident on AYE (towards Tuas) after Jurong Port Rd Exit. Avoid lane 3./d:Message

I have this expression that extract from word after until Exit.
(?i) after (?P.[^.]*?Exit)

As this look for word Exit only, how do I add other situation such as Rd|Entrance ?
I tried (?i) after (?P.[^.]*?(Exit|Entrance|Rd)), it gives me Invalid regex: no named extraction at position 39 (i.e., "?(Exit|Ent..."). Expected "(?Ppattern)"

Tags (2)
0 Karma
1 Solution

Explorer

After hours of trying, solved by (?i) (?P<dummyone>on) (?P<onexpressway>[^.]+?)\s+(?:\([^)]*?\)\s+)?(?P<dummytwo>at|after|before) (?P<locationaccident>[^.]*?(?P<dummythree>Exit|Flyover|Tunnel|Exit\.|Rd\.|Entrance\.|Ave\.|Avenue\.|North\.|South\.|East\.|West\.|[1-99]\.|BKE\.|SLE\.|CTE\.|ECP\.|KJE\.|TPE\.|PIE\.|AYE\.|Kayu\.|Way\.|Halus\.|Circus\.|Link\.|Highway\.|Tuas\.|Bahagia\.|Merah\.|Limau\.|Park\.|Lay\.|Drive\.|Dr\.|Queensway\.|Village\.|Town\.|Crescent\.|Link\.|Payoh\.|Kechil\.|Central\.))

View solution in original post

0 Karma

Explorer

After hours of trying, solved by (?i) (?P<dummyone>on) (?P<onexpressway>[^.]+?)\s+(?:\([^)]*?\)\s+)?(?P<dummytwo>at|after|before) (?P<locationaccident>[^.]*?(?P<dummythree>Exit|Flyover|Tunnel|Exit\.|Rd\.|Entrance\.|Ave\.|Avenue\.|North\.|South\.|East\.|West\.|[1-99]\.|BKE\.|SLE\.|CTE\.|ECP\.|KJE\.|TPE\.|PIE\.|AYE\.|Kayu\.|Way\.|Halus\.|Circus\.|Link\.|Highway\.|Tuas\.|Bahagia\.|Merah\.|Limau\.|Park\.|Lay\.|Drive\.|Dr\.|Queensway\.|Village\.|Town\.|Crescent\.|Link\.|Payoh\.|Kechil\.|Central\.))

View solution in original post

0 Karma

Explorer

Splunk doesn't like unnamed groups. Hope this will help some people 😃

0 Karma