Splunk Search

Field transformation on source not working

Explorer

Hi There,

There is no content in dummy field although the regex works fine. Please could you help me with this?

Type: Regex-based
Regular expression: "(\/\w+){2}\/(?.?)\/"

Tried "(\/\w+){2}\/(?.
?)\/" in source

Source Key: source

Checked create multi valued fields.

same source field content is as below:
/folder1/folder2/SAMPLE1/Test.log
/folder1/folder2/SAMPLE2/Test.log

0 Karma

Explorer

This worked after | extract reload=true. However, output is displayed at times and doesn't show any at other times. Is there any way to extend the search time or what is the alternative way to fix this problem?
index = * sourcetype=xxxx| dedup pathName | sort pathName | table pathName

0 Karma

SplunkTrust
SplunkTrust

There may be typos in your regular expressions. Please edit your question and put the regex strings inside backtics ('`') so all characters are preserved.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

Regular expression inside the brackets: ('(\/\w+){2}\/(?.*?)\/')

In other blogs there is a mention of adding fields to *.conf's I do not have access for all those. Is there any workaround with UI Field transformers ?

0 Karma

SplunkTrust
SplunkTrust

That regex has an error in it. The leading question mark in the "(?.*?)" bit is out of place. Perhaps it's supposed to be field extraction? If so, putting the entire regex inside back ticks will make it visible (or highlight it and click the "101010" button.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer
0 Karma

SplunkTrust
SplunkTrust

Have you tried this alternative regex (\/\w+){2}\/(?<dummy>[^\/]*)\/?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

this is not working, is there any different method to display the output of this transformation ?

0 Karma

SplunkTrust
SplunkTrust

The /opt/splunk/bin/pcregextest command will show how Splunk is interpreting your regex string, which is likely to be different from web pages like regex101.com.

What is the context for this regex? Can you share the stanza in which it is used?

---
If this reply helps you, an upvote would be appreciated.
0 Karma