Splunk Search

Help with field extraction regex

snallam123
Path Finder

- com.texh.servers.policy.assertion.ServerAuditDetailAssertion:
com.texh.log.custom.Applications:
com.texh.log.custom.paymentRedirects:
com.texh.log.custom.Permission:
com.texh.logs.system.Application:
com.texh.logs.policy.assertion:

| rex field=_raw "^(?:[^ \n]* ){6}(?P[^ ]+)" and "^(.\w*?):"

I tried above but it's not correct.

I need to extract these: ServerAuditDetailAssertion, Applications paymentRedirects Permission Application assertion to any new field.

Can someone help me with this?

0 Karma
1 Solution

dmarling
Builder

This regex will accomplish that. Here's a run anywhere example as well to demonstrate it: | rex field=_raw max_match=0 "com\..*\.(?<field>[^\:]+)"

| makeresults count=1
| eval _raw="com.texh.servers.policy.assertion.ServerAuditDetailAssertion:
com.texh.log.custom.Applications:
com.texh.log.custom.paymentRedirects:
com.texh.log.custom.Permission:
com.texh.logs.system.Application:
com.texh.logs.policy.assertion"
| rex field=_raw max_match=0 "com\..*\.(?<field>[^\:]+)"

alt text

If this comment/answer was helpful, please up vote it. Thank you.

View solution in original post

dmarling
Builder

This regex will accomplish that. Here's a run anywhere example as well to demonstrate it: | rex field=_raw max_match=0 "com\..*\.(?<field>[^\:]+)"

| makeresults count=1
| eval _raw="com.texh.servers.policy.assertion.ServerAuditDetailAssertion:
com.texh.log.custom.Applications:
com.texh.log.custom.paymentRedirects:
com.texh.log.custom.Permission:
com.texh.logs.system.Application:
com.texh.logs.policy.assertion"
| rex field=_raw max_match=0 "com\..*\.(?<field>[^\:]+)"

alt text

If this comment/answer was helpful, please up vote it. Thank you.

View solution in original post

snallam123
Path Finder

@dmarling Thanks, I got it.

This one worked

0 Karma

triest
Communicator

Can you please clarify exactly what output you want? I've read your question, but I'm not sure what you are trying to do. Are there values after the colon? Are you looking for one field or multiple?

Could you maybe list the exact log message (anonymity, but have representative data in its place) with a table of field and expect value. There are many regex gurus here, but to me at least its not clear what you are requesting.

0 Karma

snallam123
Path Finder

Hello @triest , I just need the regex one. I am looking for extracting a field starting with "com." and last word before ":"

"com.....assertion:" I just want to do stats of field extracted from a word before colon.

eg:

My events: (are not indexed correctly)
com.texh.logs.policy.assertion: 0880
com.texh.log.custom.exemptions:
com.texh.log.custom.payment: 8800:
com.texh.log.call.Permission: ABCD: dshhvnk dndsvndskjvdscn: jdcnvfdkjvnfdkv:
com.texh.logs.system.Application: 8877:

If i do | rex field=_raw max_match=0 ".(?[^.]+):\s+\d+:" | stats count by foo it is not extracting all fields

My results should be:

foo                              count
assertion                    10
excemptions                 20
Payment                        30
Permission                    40
Application                    50

To my understanding

index=test sourcetype=test
| rex field=_raw " .com.texh.log.custom.exemptions:" (rexfield extracting com.texh.log.custom.exemptions:)
| rex field=foo "(?regex for extracting a word before :)"
| stats count by bar

Thanks for response...

0 Karma