Splunk Search

Help with regex

pdash
Path Finder

I have a log format that uses space as delim and "" as delim when we have space in between. How should i write the rex to split these fields out?

02-27-2014/04:30:21-0700 11.23.13.41 64.13.30.50 96.42.90.80 HTTP/1.1 GET abc.defghi.com /cs/aabd/ajax/ajax.wp 200 25575 642 35633 "?lcid=2401&mobile=false" "-" "TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0" "-"

Tags (2)
0 Karma

lukejadamec
Super Champion

I would use this, but not in a search string with rex. You should use EXTRACT in props.conf with other parameters for the sourcetype.

[yoursourcetype]

EXTRACT-multifieldx = ^(?<datetimetz>\d+-\d+-\d+/\d+:\d+:\d+-\d+)\s(?<IP1>\d+\.\d+\.\d+\.\d+)\s(?<IP2>\d+\.\d+\.\d+\.\d+)\s(?<IP3>\d+\.\d+\.\d+\.\d+)\s(?<protocol>.*)\s(?<method>\w+)\s(?<site>.*)\s(?<path>.*)\s(?<metric1>\d+)\s\s(?<metric2>\d+)\s(?<metric3>\d+)\s(?<metric4>\d+)\s"(?<string1>[^"]+)"\s"(?<string2>[^"]+)"\s"(?<string3>[^"]+)"\s"(?<string4>[^"]+)"\s

0 Karma

pdash
Path Finder

Correct. So my delims would be both space and " ". And the number of fields is always same.

0 Karma

lukejadamec
Super Champion

Are these the fields you're trying to extract?
02-27-2014/04:30:21-0700
11.23.13.41
64.13.30.50
96.42.90.80
HTTP/1.1
GET
abc.defghi.com
/cs/aabd/ajax/ajax.wp
200
25575
642
35633
"?lcid=2401&mobile=false"
"-"
"TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0"
"-"

0 Karma

aholzer
Motivator

If I understand correctly, you want the following:
field1="?lcid=2401&mobile=false"
field2="-"
field3="TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0"
field4="-"

Is this correct?
If the number of fields (extractions) is always the same, you could define a regex as follows:

"(?P[^"]*)"\s"(?P[^"]*)"\s"(?P[^"]*)"\s"(?P[^"]*)"

If the number of fields is not fixed, then the above won't work

0 Karma

pdash
Path Finder

splunk 5.0

0 Karma

lukejadamec
Super Champion

What version of splunk are you using?

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...