How to insert IF in regular expression

[andreac81]

Hi to all, I should extract some fields by a log file, in the log file in some cases I have a field (i.e. field1, in other cases I have another field (i.e. field2).

For example the log file can contain field1=value1 or field2=value2

I need to do something like

IF log contains filed1 
EXTRACT- field1 =.*field1=(?P<field1>\w+).*
ELSE
EXTRACT- field2 =.*field2=(?P<field2>\w+).*

Is it possible?
Thanks,
Andrea

[alemarzu]

Hi there, perhaps something like this might work for you.

In props.conf add this:

[<your_sourcetype>]
TRANSFORMS-kv_xtraction = kv_extraction

In transforms.conf add this:

[kv_extraction]
REGEX = \s([^\s]+)=([^\s]+)
FORMAT = $1::$2

Hope it helps.

[somesoni2]

The values seems to be standard key-value pair with equal sign as delimiter. Is Splunk not extracting them automatically for you (try to run the search in Smart Mode)?

Also, an event will contain either of field1 or field2, so do you want to extract them as separate field name (field1 or field2) or just a common name (say fieldname) so that you can correlate them? If you can use a common name, try like this

[yoursourcetype]
EXTRACT-fieldname = (field1|field2)=(?<fieldname>\w+)

[andreac81]

Using
EXTRACT-fieldname = (field1|field2)=(?\w+)
I store both field1 or field2 in fieldname, I need to store field1 in fieldname1 and field2 in fieldname2 considering that the log file can contains sometimes field1 other times field2

Thanks

[somesoni2]

Is Splunk not extracting them for you automatically? can we have some sample events which contains field1 and field2 ?

A simpler option would be to just setup two field extractions, one for field1 and one for field2. For events where field2 is not there, it won't extract anything anyways (null value).

[yoursourcetype]
 EXTRACT-field1= field1=(?<field1>\w+)
 EXTRACT-field2= field2=(?<field2>\w+)