I'm trying to use the following search to capture information regarding an identification code:
index=calabrio MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS
| rex field=_raw "Filename(?<phoneid>)(?=[A-Z][A-Z][A-Z]).*(?=-)"
| stats count by phoneid
Here an example of the log entry:
2023-01-04 15:08:09.001175 DEBUG [0xce4] VoiceRecorderUpdateTask.cpp[28] VoiceRecorderUpdateTask::runTask: MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS : Filename(4281-1672873674000-4125-SEP12345678-98962688)
I want to capture the information from the 4th stanza. I'm trying to use lookahead to target the three alpha characters. This works as expected in regex101.com but Splunk is not producing any results. I've read in several articles that lookahead doesn't work as you would expect it to but I haven't been able to piece together a search that will work. Maybe I'm going about this the wrong way. Any help is appreciated.
Thanks,
Mike
As you've read, Splunk does not do well with lookahead (or lookbehind). Fortunately, lookahead rarely is necessary. Try this regex to get the three letters in the Filename field.
Filename\([\d-]+(?<phoneid>[A-Z]{3})
Thanks @richgalloway and @gcusello for your quick replies! Ultimately, Rich's search served my needs best. One funny oddity, I needed to use the dash after the stanza as a delimiter and lookahead worked just fine in that capacity.
index=calabrio MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS
| rex field=_raw "Filename\([\d-]+(?<phoneid>[A-Z]{3}.*(?=-))"
| stats count by phoneid
Hi @mikecal,
i you want to extract the full phoneid, you can use :
index=calabrio MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS
| rex "Filename\((?<phoneid>[^\)]+)"
| stats count by phoneid
that you can test at https://regex101.com/r/o6MmDk/1
if you want only the last numbers, you can use
index=calabrio MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS
| rex "Filename\(\w+-\w+-\w+-\w+-(?<IBAN>[^\)]+)"
| stats count by phoneid
that you can test at https://regex101.com/r/o6MmDk/2
Ciao.
Giuseppe
As you've read, Splunk does not do well with lookahead (or lookbehind). Fortunately, lookahead rarely is necessary. Try this regex to get the three letters in the Filename field.
Filename\([\d-]+(?<phoneid>[A-Z]{3})