Splunk Search

How do I capture the repeating pattern on multiple lines with REX?

clintla
Contributor

With this dataset, the linebreaker is zone:

 zone:  zone_1wwns
        00:00:00:00:00:00:00:01

 zone:  zone_2wwns
        00:00:00:00:00:00:00:02
        00:00:00:00:00:00:00:03

 zone:  zone_3wwns  
        00:00:00:00:00:00:00:04
        00:00:00:00:00:00:00:05
            00:00:00:00:00:00:00:06

When I use the regex:

| rex max_match=0 "zone:\s+(?\w+)((\s+(?\S\S\:\S\S\:\S\S\:\S\S\:\S\S\:\S\S\:\S\S\:\S\S))+)"

It captures the last wwn, when I remove the (+) at the end, then it captures the first wwn

When I do this search w/ Notepad++ it finds all wwns (my most used tool for testing rex). Seems like this should work.
Is there another way to capture these possible extra lines?

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try (runanywhere sample, everything before rex command is to generate sample data)

| gentimes start=-1 | eval raw="zone: zone_1wwns
 00:00:00:00:00:00:00:01
##zone: zone_2wwns
 00:00:00:00:00:00:00:02
 00:00:00:00:00:00:00:03
##zone: zone_3wwns
 00:00:00:00:00:00:00:04
 00:00:00:00:00:00:00:05
 00:00:00:00:00:00:00:06" | table raw | makemv raw delim="##" | mvexpand raw 
| rex field=raw max_match=0 "zone:\s+(?<zone>\w+)[\r\n\s](?<ZoneVal>\s*((\d{2}\:)+\d+[\r\n\s]*)+)"

View solution in original post

0 Karma

clintla
Contributor

"This is close.. although it takes all the ZoneVal & lops them into the same field value. I need them to be different values.

after rethinking it, broke into 2 rex's.

| rex "zone:\s+(?\S+)"
| rex max_match=0 "(?\S\S:\S\S:\S\S:\S\S:\S\S:\S\S:\S\S:\S\S)"

That nailed it... although dang it! my first attempt should have worked! 🙂 "

0 Karma

somesoni2
Revered Legend

Give this a try (runanywhere sample, everything before rex command is to generate sample data)

| gentimes start=-1 | eval raw="zone: zone_1wwns
 00:00:00:00:00:00:00:01
##zone: zone_2wwns
 00:00:00:00:00:00:00:02
 00:00:00:00:00:00:00:03
##zone: zone_3wwns
 00:00:00:00:00:00:00:04
 00:00:00:00:00:00:00:05
 00:00:00:00:00:00:00:06" | table raw | makemv raw delim="##" | mvexpand raw 
| rex field=raw max_match=0 "zone:\s+(?<zone>\w+)[\r\n\s](?<ZoneVal>\s*((\d{2}\:)+\d+[\r\n\s]*)+)"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Notepad++ is great, but I believe it does not use a Perl-compatible regex engine (PCRE) like Splunk does. Most folks here use regex101.com to test their regular expressions.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Clear text password in command line

mogod command line argument having clear text password like "--sslPEMKeyPassword=password"how to avoid clear ...

Checksum mismatch on Deployment Clients which were rebuilt with same IP but different ...

We recently rebuilt a server which had splunk UF installed. After the rebuild, the IP remained same but ...

KVStore failure after upgrade to 9.0

After upgrading to Splunk 9.0 on a single instance, we occasionally get KV Store errors.&nbsp;<span ...