- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Help with regex
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Help with regex
I have a log format that uses space as delim and "" as delim when we have space in between. How should i write the rex to split these fields out?
02-27-2014/04:30:21-0700 11.23.13.41 64.13.30.50 96.42.90.80 HTTP/1.1 GET abc.defghi.com /cs/aabd/ajax/ajax.wp 200 25575 642 35633 "?lcid=2401&mobile=false" "-" "TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0" "-"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would use this, but not in a search string with rex. You should use EXTRACT in props.conf with other parameters for the sourcetype.
[yoursourcetype]
EXTRACT-multifieldx = ^(?<datetimetz>\d+-\d+-\d+/\d+:\d+:\d+-\d+)\s(?<IP1>\d+\.\d+\.\d+\.\d+)\s(?<IP2>\d+\.\d+\.\d+\.\d+)\s(?<IP3>\d+\.\d+\.\d+\.\d+)\s(?<protocol>.*)\s(?<method>\w+)\s(?<site>.*)\s(?<path>.*)\s(?<metric1>\d+)\s\s(?<metric2>\d+)\s(?<metric3>\d+)\s(?<metric4>\d+)\s"(?<string1>[^"]+)"\s"(?<string2>[^"]+)"\s"(?<string3>[^"]+)"\s"(?<string4>[^"]+)"\s
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Correct. So my delims would be both space and " ". And the number of fields is always same.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are these the fields you're trying to extract?
02-27-2014/04:30:21-0700
11.23.13.41
64.13.30.50
96.42.90.80
HTTP/1.1
GET
abc.defghi.com
/cs/aabd/ajax/ajax.wp
200
25575
642
35633
"?lcid=2401&mobile=false"
"-"
"TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0"
"-"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I understand correctly, you want the following:
field1="?lcid=2401&mobile=false"
field2="-"
field3="TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0"
field4="-"
Is this correct?
If the number of fields (extractions) is always the same, you could define a regex as follows:
"(?P
If the number of fields is not fixed, then the above won't work
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunk 5.0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What version of splunk are you using?
Welcome to the Splunk Community!
Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM
Adoption of RUM and APM at Splunk
