Splunk Search

Help with improving Regex

youngsuh
Contributor

Here is the regex to extract message_type based on CIM.  Could anyone make this faster than 1387 steps?

https://regex101.com/r/dHbs4i/1

 

(?P<message_type>[^.]query|response)\:

 

 

Here is the sample syslog for DNS.

 

Feb  3 00:42:32 FSTAd2346.g.ae3.dns.mil tmm[19902] 2021-02-03 00:42:32 FSTAd2346.g.ae3.dns.mil qid 26818 from 10.130.27.34#13258: view none: query: a-grv-gocdzace.g.ae3.dns.mil IN A + (10.130.44.87%0)
Feb  3 00:42:32 FSTAd2346.g.ae3.dns.mil tmm[19902] 2021-02-03 00:42:32 FSTAd2346.g.ae3.dns.mil qid 57035 to 10.130.27.34#13258: [NOERROR qr,aa,rd] response: a-grv-gocdzace.g.ae3.dns.mil

 

   

Labels (2)
Tags (1)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

This executes with 50 steps with the given sample data.

 

(?<message_type>query|response)\:

 

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Unless you really need to have the [\.] in the regex, i.e. you want to match any character in front of the word query, other than the '.' character and to include this in your message type then you should use one of the suggestions.

NB, you don't need the \ in front of :

 

manjunathmeti
SplunkTrust
SplunkTrust

This executes with 50 steps with the given sample data.

 

(?<message_type>query|response)\:

 

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @youngsuh,

Below is working in 163 steps based on your sample data. 

\s(?P<message_type>query|response)\:

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...