Splunk Search

Help with improving Regex

youngsuh
Path Finder

Here is the regex to extract message_type based on CIM.  Could anyone make this faster than 1387 steps?

https://regex101.com/r/dHbs4i/1

 

(?P<message_type>[^.]query|response)\:

 

 

Here is the sample syslog for DNS.

 

Feb  3 00:42:32 FSTAd2346.g.ae3.dns.mil tmm[19902] 2021-02-03 00:42:32 FSTAd2346.g.ae3.dns.mil qid 26818 from 10.130.27.34#13258: view none: query: a-grv-gocdzace.g.ae3.dns.mil IN A + (10.130.44.87%0)
Feb  3 00:42:32 FSTAd2346.g.ae3.dns.mil tmm[19902] 2021-02-03 00:42:32 FSTAd2346.g.ae3.dns.mil qid 57035 to 10.130.27.34#13258: [NOERROR qr,aa,rd] response: a-grv-gocdzace.g.ae3.dns.mil

 

   

Labels (2)
Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

This executes with 50 steps with the given sample data.

 

(?<message_type>query|response)\:

 

 

View solution in original post

0 Karma

bowesmana
Champion

Unless you really need to have the [\.] in the regex, i.e. you want to match any character in front of the word query, other than the '.' character and to include this in your message type then you should use one of the suggestions.

NB, you don't need the \ in front of :

 

manjunathmeti
Champion

This executes with 50 steps with the given sample data.

 

(?<message_type>query|response)\:

 

 

View solution in original post

0 Karma

scelikok
Influencer

Hi @youngsuh,

Below is working in 163 steps based on your sample data. 

\s(?P<message_type>query|response)\:

 

If this reply helps you an upvote is appreciated.