Splunk Search

How do I write the regex to capture the database name and major version from my sample data?

vinay4444
Explorer

I am struggling with the regex match on the below pattern. I need to capture major version name from below ( DB2 9.7,DB2 10.1 ) . Pretty much first letter till second "." . Any help?

DB2 9.7.10.1
DB2 10.1.4.4
DB2 9.7.600.413
DB2 9.7.9.8

0 Karma
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

Try this:

| rex "DB2(?<version>\s\d+\.\d+)"

it will be non permanent. and only exist for the single search.


Based on the fact that this is relatively simple regular expression, I will leave some links here to help you learn.

  1. http://regexone.com/ - this is a great interactive tutorial
  2. https://regex101.com/ - test out your regex ! example: https://regex101.com/r/eF7oF2/1
  3. Splunk Regular Expressions - docs are great
  4. Regular Expression Tutorial

View solution in original post

Sebastian2
Path Finder

No look all in:

# To extract the Version like "x.y" only:
/DB2\s(\d+\.\d+).*/i
# To extract the whole thing like "DB2 x.y"
/(DB2\s\d+\.\d+).*/i

I have to add, that I'm not sure if this actually fits 100% into Splunk. If you want to extract a field via props.conf it would be something like this:

EXTRACT-major_version = DB2\s(?P<major_version>\d+\.\d+).*

To use a regex inline in a search it would be

... |rex "DB2\s(?<major_version>\d+\.\d+).*"
0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Try this:

| rex "DB2(?<version>\s\d+\.\d+)"

it will be non permanent. and only exist for the single search.


Based on the fact that this is relatively simple regular expression, I will leave some links here to help you learn.

  1. http://regexone.com/ - this is a great interactive tutorial
  2. https://regex101.com/ - test out your regex ! example: https://regex101.com/r/eF7oF2/1
  3. Splunk Regular Expressions - docs are great
  4. Regular Expression Tutorial

vinay4444
Explorer
index=XXXX  | rex field=databaseDbServerVersion "DB2(?\s\d+\.\d+)" | table version

Thanks version now has correct result 10.1,10.5 etc but is there a way to get DB2 10.1 , DB2 9.7 in version

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Just change

"DB2(?<version>\s\d+\.\d+)"

to

"(?<version>DB2\s\d+\.\d+)"

Everything inside of the parenthesis is going to be "captured". Everything outside of the parenthesis is going to be "matched".

0 Karma

sundareshr
Legend

Try this

(\w+\s\d+\.\d+)

vinay4444
Explorer

index=XXXX | rex field=databaseDbServerVersion "DB2(?\s\d+.\d+)" | table version

Thanks version now has correct result 10.1,10.5 etc but is there a way to get DB2 10.1 , DB2 9.7 in version

0 Karma

sundareshr
Legend

(\w+\s\d+\.\d+) will give you exactly what you asked for.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...