Splunk Search

How do I write the regex to capture the database name and major version from my sample data?

vinay4444
Explorer

I am struggling with the regex match on the below pattern. I need to capture major version name from below ( DB2 9.7,DB2 10.1 ) . Pretty much first letter till second "." . Any help?

DB2 9.7.10.1
DB2 10.1.4.4
DB2 9.7.600.413
DB2 9.7.9.8

0 Karma
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

Try this:

| rex "DB2(?<version>\s\d+\.\d+)"

it will be non permanent. and only exist for the single search.


Based on the fact that this is relatively simple regular expression, I will leave some links here to help you learn.

  1. http://regexone.com/ - this is a great interactive tutorial
  2. https://regex101.com/ - test out your regex ! example: https://regex101.com/r/eF7oF2/1
  3. Splunk Regular Expressions - docs are great
  4. Regular Expression Tutorial

View solution in original post

Sebastian2
Path Finder

No look all in:

# To extract the Version like "x.y" only:
/DB2\s(\d+\.\d+).*/i
# To extract the whole thing like "DB2 x.y"
/(DB2\s\d+\.\d+).*/i

I have to add, that I'm not sure if this actually fits 100% into Splunk. If you want to extract a field via props.conf it would be something like this:

EXTRACT-major_version = DB2\s(?P<major_version>\d+\.\d+).*

To use a regex inline in a search it would be

... |rex "DB2\s(?<major_version>\d+\.\d+).*"
0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Try this:

| rex "DB2(?<version>\s\d+\.\d+)"

it will be non permanent. and only exist for the single search.


Based on the fact that this is relatively simple regular expression, I will leave some links here to help you learn.

  1. http://regexone.com/ - this is a great interactive tutorial
  2. https://regex101.com/ - test out your regex ! example: https://regex101.com/r/eF7oF2/1
  3. Splunk Regular Expressions - docs are great
  4. Regular Expression Tutorial

vinay4444
Explorer
index=XXXX  | rex field=databaseDbServerVersion "DB2(?\s\d+\.\d+)" | table version

Thanks version now has correct result 10.1,10.5 etc but is there a way to get DB2 10.1 , DB2 9.7 in version

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Just change

"DB2(?<version>\s\d+\.\d+)"

to

"(?<version>DB2\s\d+\.\d+)"

Everything inside of the parenthesis is going to be "captured". Everything outside of the parenthesis is going to be "matched".

0 Karma

sundareshr
Legend

Try this

(\w+\s\d+\.\d+)

vinay4444
Explorer

index=XXXX | rex field=databaseDbServerVersion "DB2(?\s\d+.\d+)" | table version

Thanks version now has correct result 10.1,10.5 etc but is there a way to get DB2 10.1 , DB2 9.7 in version

0 Karma

sundareshr
Legend

(\w+\s\d+\.\d+) will give you exactly what you asked for.

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...