Splunk Search

Field extractions: How to use same fieldname multiple times in a one long regular expression?

New Member

There is a regular expression which is extracting a user field ( Field Extractor). This is basically a combination of 2 different regular expressions that are joined with an OR condition.

(?i)\[.*?\],? ?(?P[a-z_-]+)(?=\])|(?i)\(.*?\..*?\) \[(?P[A-Z_-]+)\]

Problem: I want to use the same variable name, but in order to make it work currently, I need to use 2 different names ( user1 and user2) as below.

(?i)\[.*?\],? ?(?P[a-z_-]+)(?=\])|(?i)\(.*?\..*?\) \[(?P[A-Z_-]+)\]

Can you suggest a solution to make it work just with one fieldname variable?

Thanks,

0 Karma

Communicator

If you add the "J" option at the start of the regex you can use the same field name multiple times.

so it would become

(?iJ)\[.*?\],? ?(?<user>[a-z_-]+)(?=\])|(?iJ)\(.*?\..*?\) \[(?<user>[A-Z_-]+)\]

SplunkTrust
SplunkTrust

In my experience, regex strings cannot use the same capture name more than once even if an OR condition means only one group will be used.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Motivator

could you post some sample data?

0 Karma

New Member

Here is the string and CC_TESTDZKO, CC_ASAXENA are the users, I am trying to read through field extractor .

(manager.ManagerImpl) [xxxx_B], CC_TESTDZKO [CC_ASAXENA]

Thanks,
Amit Saxena

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!