How to drop brackets from field extraction result?

[vcorral]

I have some logs that are very inconsistent and need to get a source number that is displayed one of few different ways:

  Source Number: 47107
  Source id: Meter <47107>
  Source id: 47107

I can successfully weed out all of the Source prefixes, but I can't find a way to remove the "<" and ">" from the field extraction. Here is what I have tried so far:

(?:Source\sid:|Source\sNumber:)(?:\sMeter\s|\s)(?<MeterNumber>((?:<)\d*(?:>)|\d*))

We can see that I tried ignoring the "<" and ">", but they are still showing up in search results.

Is there any way I can drop them as part of the field extraction?
Thanks in advance!
Virgil

[evania]

Hi @vcorral ,

Did you have a chance to check out these answers yet? If any of them worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.

Thanks for posting!

[vcorral]

Thank you all for your quick and informative responses. I was too far into the issue and could not see the forest through the trees. I did move the "<" outside of the named capture group and added it to the one string that utilized it in the preceding non-capture group.

I also changed the "\d*" to "\d+", thanks for keeping me straight on that.

My new REGEX is as follows:

(?:Source\sid:|Source\sNumber:)(?:\sMeter\s<|\s)(?<MeterNumber>(\d+))

[anthonymelita]

In Splunk because you only really care about the named extracted field, you don't need to worry about the non-capture groups. Just move the bracket outside the extraction:

(Source\sid:|Source\sNumber:)(\sMeter\s|\s)(<*)(?\d+)

I had to change the d(star) to d+ because it's interpreting as italics

[MuS]

Hi vcorral,

Please give this regex a try:

 Source (?:Number|id):[\s\w\<]+?(?<myNumber>\d+)

cheers, MuS