Splunk Search

Help with improving Regex

youngsuh
Contributor

Here is the regex to extract message_type based on CIM.  Could anyone make this faster than 1387 steps?

https://regex101.com/r/dHbs4i/1

 

(?P<message_type>[^.]query|response)\:

 

 

Here is the sample syslog for DNS.

 

Feb  3 00:42:32 FSTAd2346.g.ae3.dns.mil tmm[19902] 2021-02-03 00:42:32 FSTAd2346.g.ae3.dns.mil qid 26818 from 10.130.27.34#13258: view none: query: a-grv-gocdzace.g.ae3.dns.mil IN A + (10.130.44.87%0)
Feb  3 00:42:32 FSTAd2346.g.ae3.dns.mil tmm[19902] 2021-02-03 00:42:32 FSTAd2346.g.ae3.dns.mil qid 57035 to 10.130.27.34#13258: [NOERROR qr,aa,rd] response: a-grv-gocdzace.g.ae3.dns.mil

 

   

Labels (2)
Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

This executes with 50 steps with the given sample data.

 

(?<message_type>query|response)\:

 

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Unless you really need to have the [\.] in the regex, i.e. you want to match any character in front of the word query, other than the '.' character and to include this in your message type then you should use one of the suggestions.

NB, you don't need the \ in front of :

 

manjunathmeti
Champion

This executes with 50 steps with the given sample data.

 

(?<message_type>query|response)\:

 

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @youngsuh,

Below is working in 163 steps based on your sample data. 

\s(?P<message_type>query|response)\:

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...