Splunk Search

Field extraction regex expression to pull information after a pattern

Path Finder

I am trying to get regex working for a field extraction on some SSRS logs I have indexed in our deployment. My goal is to extract the data after INFO:. So in the below example, I am trying to extract Call to GetSystemPropertiesAction(). as a field I will label as INFO. Here is an example of one of the lines in the index:

library!ReportServer_0-370!3120!04/24/2015-10:49:19:: i INFO: Call to GetSystemPropertiesAction().

When I put the following regex into the regex101 application I extract the correct data:

(?<=INFO:).*

When I try to put that regex expression into the field extraction, it does not return any values in the preview.

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Since you're asking Splunk to basically walk thru the event and find your match, it's not advisable to use something like any of the "lookbehind" directives because you want to move forward... not have the regex running back and forth looking for your stuff. Just for efficiency in parsing.

To create a field, you need a "named" capturing group... not just a capturing group (unless you're doing this in transforms, where you can specify the format and use a "hard code" filename with each capturing group.

Also, if the INFO: only appears where there IS definitely some info after it (I would imagine it is so) you don't have to use the super greedy * (zero or more) where + (one or more is perfectly acceptable)

INFO:(?P<INFO>.+)

For the most part... extracting fields best practices is

  • Find something to anchor on (in your case 'INFO:') and walk forward...

  • And if there is nothing to anchor to... start at the beginning of the event and walk forward until you get to the part you want to capture.

That is the most performant way to approach regex use in Splunk.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

SplunkTrust
SplunkTrust

Your regex string has no groups so nothing is extracted. Try this:

INFO:(?P<INFO>.*)
---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!