Splunk Search

How to copy/paste a regex into splunk

mikefoti
Communicator

My ultimate goal is to create a regex expression that can be used use to extract fields from any record made up comma-seperated fields. For example, if a normal event looks like this:

"RADSP01HDQRW","IAS",04/02/2012,16:14:38,2,,"RETAIL\HH01-9002",,,,,,,,0,"10.170.191.48"

it will always contain 15 commas, therefore 16 fields.

I created the regex expression below and tested it with UltraEditPro.

[^,](?=(,[^,]){15,15}$)

It will find the 1st field. In order to make it find the 2nd field I simply replace (15,15) with (14,14).

Everything looked great in UltraEdit but when I pasted it into the Field Extraction UI
it complained...

Invalid regex: no named extraction at position 7 (i.e., "=(,[^,]*){..."). Expected "(?Ppattern)"

I tried various combinations before thinking surely someone else has already tackled this problem... so here's hoping!

Tags (1)
0 Karma
1 Solution

tgow
Splunk Employee
Splunk Employee

Since you have a delimiter that is separating your fields then I would take a look at the following:

$SPLUNK_HOME/etc/system/local/props.conf

[data]
REPORT-fieldextract = fieldextract

$SPLUNK_HOME/etc/system/local/transforms.conf

[fieldextract]
DELIMS = ","
FIELDS = field1,field2,field3,...field16

Remember that this field extraction happens at index time so this will only work for the latest data.

Here is a link to more information:

http://docs.splunk.com/Documentation/Splunk/4.3.1/Admin/Transformsconf

View solution in original post

tgow
Splunk Employee
Splunk Employee

Since you have a delimiter that is separating your fields then I would take a look at the following:

$SPLUNK_HOME/etc/system/local/props.conf

[data]
REPORT-fieldextract = fieldextract

$SPLUNK_HOME/etc/system/local/transforms.conf

[fieldextract]
DELIMS = ","
FIELDS = field1,field2,field3,...field16

Remember that this field extraction happens at index time so this will only work for the latest data.

Here is a link to more information:

http://docs.splunk.com/Documentation/Splunk/4.3.1/Admin/Transformsconf

MarioM
Motivator

Fields extractions are on the search head then if your indexer is the search head too then you should put it there.
Your sencond extraction via delims looks right.

0 Karma

mikefoti
Communicator

Thanks for the reply. I read the props and transforms documentation and am unclear if the edits need to be in these files on the indexer or the UF.

Also, if I want to extract the csv fields only for sourcetype=foo, does this look right?

Props.conf [sourcetype::foo]
report_radius=extract_radius_CSV

Transforms.conf: [extract_radius_CSV]
DELIMS=”,”
FIELDS=”nps_svrName”,”nps_svcName”,”nps_Date”,”nps_Time”,”nps_packetType,”nps_userName”,”nps_userFQDN”,”nps_calledStation”,”nps_callingStation”

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...