Splunk Search

How to manage multiple regex using same field name

att35
Builder

We have application data coming from Apache Tomcat's and have a regex in place to extract exception name. But there are some tomcats sending data in a slightly different formats and the extraction doesn't work for them. 

I have updated regex ready for these different formats, but want to keep the field name same, i.e. exception.

How Do I manage multiple extractions against the same sourcetype while keeping the field names same? If I add these regex in transforms, would they end up conflicting with each other? 

Or should I be creating them into different fields, such as exception1, exception2 and then use coalesce to eventually merge them into a single field?

Labels (3)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @att35,

I usually use the different names and coalesce solution in a calculated field.

Ciao.

Giuseppe

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you can establish sufficiently unique anchors in your regex, you might be able to use pipe-delimited options e.g.

(anchor 1|anchor 2|anchor 3)(?<field>field pattern)

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @att35,

I usually use the different names and coalesce solution in a calculated field.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @att35 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...