Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Help with regex
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Help with regex
I have a log format that uses space as delim and "" as delim when we have space in between. How should i write the rex to split these fields out?
02-27-2014/04:30:21-0700 11.23.13.41 64.13.30.50 96.42.90.80 HTTP/1.1 GET abc.defghi.com /cs/aabd/ajax/ajax.wp 200 25575 642 35633 "?lcid=2401&mobile=false" "-" "TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0" "-"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would use this, but not in a search string with rex. You should use EXTRACT in props.conf with other parameters for the sourcetype.
[yoursourcetype]
EXTRACT-multifieldx = ^(?<datetimetz>\d+-\d+-\d+/\d+:\d+:\d+-\d+)\s(?<IP1>\d+\.\d+\.\d+\.\d+)\s(?<IP2>\d+\.\d+\.\d+\.\d+)\s(?<IP3>\d+\.\d+\.\d+\.\d+)\s(?<protocol>.*)\s(?<method>\w+)\s(?<site>.*)\s(?<path>.*)\s(?<metric1>\d+)\s\s(?<metric2>\d+)\s(?<metric3>\d+)\s(?<metric4>\d+)\s"(?<string1>[^"]+)"\s"(?<string2>[^"]+)"\s"(?<string3>[^"]+)"\s"(?<string4>[^"]+)"\s
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Correct. So my delims would be both space and " ". And the number of fields is always same.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are these the fields you're trying to extract?
02-27-2014/04:30:21-0700
11.23.13.41
64.13.30.50
96.42.90.80
HTTP/1.1
GET
abc.defghi.com
/cs/aabd/ajax/ajax.wp
200
25575
642
35633
"?lcid=2401&mobile=false"
"-"
"TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0"
"-"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I understand correctly, you want the following:
field1="?lcid=2401&mobile=false"
field2="-"
field3="TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0"
field4="-"
Is this correct?
If the number of fields (extractions) is always the same, you could define a regex as follows:
"(?P
If the number of fields is not fixed, then the above won't work
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunk 5.0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What version of splunk are you using?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Data Management Digest – August 2026
Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26
Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM
