Splunk Search

Help on Editing regex command on the example geven below

mgraju
New Member

hi i have the following logs
@2013-03-25 17:29:36,634||FINE|CXI|15553|Session=kksrrdica24v-2013084212936-1|CXI Diagnostic: (Interpreter::log_element)

Out of it i want to extract (Interpreter::log_element) <label='app_begin', expr='CCA:init:connection.alerting, APP-BEGIN: from first log and (Interpreter::log_element) <label='app_end', expr='CCA:end:execute_end, APP-END: from second log

when i tried IFE by giving the above mentioned example values for a field it splited (Interpreter::log_element) <label='app_begin', expr='CCA:init:connection.alerting, APP-BEGIN: into 3 separate fields because of "," in between the string and showing regex as (?:[^ \n]* ){2}(?P[^,]+),(?P[^,]+),(?P\s+\w+-\w+:)

Can some one help on this how the regex can be modified so that it will be considered whole string as one field.

Tags (1)
0 Karma

aholzer
Motivator

You could do something like this:

Diagnostic: (?P<field_name>[^\|]+)

This will pick up everything after "Diagnostic: " and before a pipe "|" and store in a field labeled "field_name"

In your examples it would extract exactly what you said you wanted:
Event1: "(Interpreter::log_element) <label='app_begin', expr="CCA:init:connection.alerting, APP-BEGIN: "
Event2: "(Interpreter::log_element) <label='app_end', expr="CCA:end:execute_end, APP-END: "

Here's a really useful link where you can test your regex: http://regexpal.com/

Note that if you test the above regex in this page it won't work due to the splunk specific field extraction syntax. you can run it as the following, and then just remember to put the "?P" where you want the field to be extracted:

Diagnostic:([^\|]+)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

\(Interpreter::log_element\).*?APP-(BEGIN|END)

bmacias84
Champion

I would consider using a transform and delimiting on the "|" (pipe), but your field length is variable. If it wasn't you could you Delim and use Source_key off your delim field.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...