Field extraction regex expression to pull information after a pattern

[Bliide]

I am trying to get regex working for a field extraction on some SSRS logs I have indexed in our deployment. My goal is to extract the data after INFO:. So in the below example, I am trying to extract Call to GetSystemPropertiesAction(). as a field I will label as INFO. Here is an example of one of the lines in the index:

library!ReportServer_0-370!3120!04/24/2015-10:49:19:: i INFO: Call to GetSystemPropertiesAction().

When I put the following regex into the regex101 application I extract the correct data:

(?<=INFO:).*

When I try to put that regex expression into the field extraction, it does not return any values in the preview.

[rsennett_splunk]

Since you're asking Splunk to basically walk thru the event and find your match, it's not advisable to use something like any of the "lookbehind" directives because you want to move forward... not have the regex running back and forth looking for your stuff. Just for efficiency in parsing.

To create a field, you need a "named" capturing group... not just a capturing group (unless you're doing this in transforms, where you can specify the format and use a "hard code" filename with each capturing group.

Also, if the INFO: only appears where there IS definitely some info after it (I would imagine it is so) you don't have to use the super greedy * (zero or more) where + (one or more is perfectly acceptable)

INFO:(?P<INFO>.+)

For the most part... extracting fields best practices is

• Find something to anchor on (in your case 'INFO:') and walk forward...

• And if there is nothing to anchor to... start at the beginning of the event and walk forward until you get to the part you want to capture.

That is the most performant way to approach regex use in Splunk.

[richgalloway]

Your regex string has no groups so nothing is extracted. Try this:

INFO:(?P<INFO>.*)