Splunk Search

How to manage multiple regex using same field name

att35
Builder

We have application data coming from Apache Tomcat's and have a regex in place to extract exception name. But there are some tomcats sending data in a slightly different formats and the extraction doesn't work for them. 

I have updated regex ready for these different formats, but want to keep the field name same, i.e. exception.

How Do I manage multiple extractions against the same sourcetype while keeping the field names same? If I add these regex in transforms, would they end up conflicting with each other? 

Or should I be creating them into different fields, such as exception1, exception2 and then use coalesce to eventually merge them into a single field?

Labels (3)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @att35,

I usually use the different names and coalesce solution in a calculated field.

Ciao.

Giuseppe

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you can establish sufficiently unique anchors in your regex, you might be able to use pipe-delimited options e.g.

(anchor 1|anchor 2|anchor 3)(?<field>field pattern)

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @att35,

I usually use the different names and coalesce solution in a calculated field.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @att35 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...