Splunk Search

How to manage multiple regex using same field name

att35
Builder

We have application data coming from Apache Tomcat's and have a regex in place to extract exception name. But there are some tomcats sending data in a slightly different formats and the extraction doesn't work for them. 

I have updated regex ready for these different formats, but want to keep the field name same, i.e. exception.

How Do I manage multiple extractions against the same sourcetype while keeping the field names same? If I add these regex in transforms, would they end up conflicting with each other? 

Or should I be creating them into different fields, such as exception1, exception2 and then use coalesce to eventually merge them into a single field?

Labels (3)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @att35,

I usually use the different names and coalesce solution in a calculated field.

Ciao.

Giuseppe

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you can establish sufficiently unique anchors in your regex, you might be able to use pipe-delimited options e.g.

(anchor 1|anchor 2|anchor 3)(?<field>field pattern)

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @att35,

I usually use the different names and coalesce solution in a calculated field.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @att35 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...