Help on Editing regex command on the example geven below

[mgraju]

hi i have the following logs
@2013-03-25 17:29:36,634||FINE|CXI|15553|Session=kksrrdica24v-2013084212936-1|CXI Diagnostic: (Interpreter::log_element) |kksrrdica24v####
@2013-03-25 17:29:11,923||FINE|CXI|15339|Session=kksrrdica24v-2013084212901-1|CXI Diagnostic: (Interpreter::log_element) |kksrrdica24v####

Out of it i want to extract (Interpreter::log_element) <label='app_begin', expr='CCA:init:connection.alerting, APP-BEGIN: from first log and (Interpreter::log_element) <label='app_end', expr='CCA:end:execute_end, APP-END: from second log

when i tried IFE by giving the above mentioned example values for a field it splited (Interpreter::log_element) <label='app_begin', expr='CCA:init:connection.alerting, APP-BEGIN: into 3 separate fields because of "," in between the string and showing regex as (?:[^ \n]* ){2}(?P[^,]+),(?P[^,]+),(?P\s+\w+-\w+:)

Can some one help on this how the regex can be modified so that it will be considered whole string as one field.

[aholzer]

You could do something like this:

Diagnostic: (?P<field_name>[^\|]+)

This will pick up everything after "Diagnostic: " and before a pipe "|" and store in a field labeled "field_name"

In your examples it would extract exactly what you said you wanted:
Event1: "(Interpreter::log_element) <label='app_begin', expr="CCA:init:connection.alerting, APP-BEGIN: "
Event2: "(Interpreter::log_element) <label='app_end', expr="CCA:end:execute_end, APP-END: "

Here's a really useful link where you can test your regex: http://regexpal.com/

Note that if you test the above regex in this page it won't work due to the splunk specific field extraction syntax. you can run it as the following, and then just remember to put the "?P" where you want the field to be extracted:

Diagnostic:([^\|]+)

[martin_mueller]

Something like this?

\(Interpreter::log_element\).*?APP-(BEGIN|END)

[bmacias84]

I would consider using a transform and delimiting on the "|" (pipe), but your field length is variable. If it wasn't you could you Delim and use Source_key off your delim field.