Splunk Search

How to create a regex to extract data?

donemery
Explorer

I am new to Regex and hopefully someone can help me. I am trying to extract data between "[" and "SFP". It doesn't matter what the data is or length of the extract as it varies.

example 1: Jul 1 13:10:07 -07:00 HOSTNAME [MIC(0/2) link 0 SFP laser bias current high warning set ]
example 2: Jul 10 16:08:20 -04:00 HOSTNAME [sfp-1/0/2 link 2 SFP laser bias current high warning set ]

Thanks!

0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

Hi @donemery

Try something like below it trims space also after 0 and before SFP. using * is not recommended:

| rex field=_raw "\[(?<my_field>[^SFP]+)\s"

The problem with * is that it will match until last occurrence of match. for example if there are two SFP(may not be in this case in general I am talking about) in log like below

Jul 1 13:10:07 -07:00 HOSTNAME [MIC(0/2) link 0 SFP laser bias current high warning set SFP

result of using * is below:

MIC(0/2) link 0 SFP laser bias current high warning set

————————————
If this helps, give a like below.

View solution in original post

ddrillic
Ultra Champion

Something like .*\[(?<ext>.*)SFP.* -

alt text

0 Karma

woodcock
Esteemed Legend

Like this

| rex "\[(?<FieldNameHere>.*?)SFP"
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Hi @donemery

Try something like below it trims space also after 0 and before SFP. using * is not recommended:

| rex field=_raw "\[(?<my_field>[^SFP]+)\s"

The problem with * is that it will match until last occurrence of match. for example if there are two SFP(may not be in this case in general I am talking about) in log like below

Jul 1 13:10:07 -07:00 HOSTNAME [MIC(0/2) link 0 SFP laser bias current high warning set SFP

result of using * is below:

MIC(0/2) link 0 SFP laser bias current high warning set

————————————
If this helps, give a like below.

donemery
Explorer

Thanks for your help! One more question if I may, how would I check for XFP or SFP in a message. The format would be identical, just the first letter could be "X" or "S". It will always be capitalized.

Thanks!

0 Karma

cstump_splunk
Splunk Employee
Splunk Employee
| rex field=_raw "\[(?<my_field>.+)(SFP|XFP)"

Also, I recommend that you play around with your regexes on regex101.com

pruthvikrishnap
Contributor
(?<=\[)(.*)(?= SFP)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Hi @pruthvikrishnapolavarapu

your regex is correct but in Splunk syntax is different and there should be at least one name group to identify what the regex is extracting.

your regex throws below error:

Error in 'rex' command: The regex '[(.*)SFP' does not extract anything. It should specify at least one named group. Format: (?...).

————————————
If this helps, give a like below.
0 Karma

pradeepkumarg
Influencer

| rex "\[(?<my_field>.*)SFP"

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...