How to create a regex to extract data?

[donemery]

I am new to Regex and hopefully someone can help me. I am trying to extract data between "[" and "SFP". It doesn't matter what the data is or length of the extract as it varies.

example 1: Jul 1 13:10:07 -07:00 HOSTNAME [MIC(0/2) link 0 SFP laser bias current high warning set ]
example 2: Jul 10 16:08:20 -04:00 HOSTNAME [sfp-1/0/2 link 2 SFP laser bias current high warning set ]

Thanks!

[ddrillic]

Something like .*\[(?<ext>.*)SFP.* -

[woodcock]

Like this

| rex "\[(?<FieldNameHere>.*?)SFP"

[thambisetty · Accepted solution]

Hi @donemery

Try something like below it trims space also after 0 and before SFP. using * is not recommended:

| rex field=_raw "\[(?<my_field>[^SFP]+)\s"

The problem with * is that it will match until last occurrence of match. for example if there are two SFP(may not be in this case in general I am talking about) in log like below

Jul 1 13:10:07 -07:00 HOSTNAME [MIC(0/2) link 0 SFP laser bias current high warning set SFP

result of using * is below:

MIC(0/2) link 0 SFP laser bias current high warning set

[donemery]

Thanks for your help! One more question if I may, how would I check for XFP or SFP in a message. The format would be identical, just the first letter could be "X" or "S". It will always be capitalized.

Thanks!

[cstump_splunk]

| rex field=_raw "\[(?<my_field>.+)(SFP|XFP)"

Also, I recommend that you play around with your regexes on regex101.com

[pruthvikrishnap]

(?<=\[)(.*)(?= SFP)

[thambisetty]

Hi @pruthvikrishnapolavarapu

your regex is correct but in Splunk syntax is different and there should be at least one name group to identify what the regex is extracting.

your regex throws below error:

Error in 'rex' command: The regex '[(.*)SFP' does not extract anything. It should specify at least one named group. Format: (?...).

[pradeepkumarg]

| rex "\[(?<my_field>.*)SFP"