Splunk Search

How to use regex to obtain a single string from a string sequence?

Nidd
Path Finder

I have not used regex in my queries much. Any help in resolving this would be much helpful.

I have the following log:

INFO | 2018-06-04 09:26:46,449 | EvergreenWorker - starting createSuspects for 262352812954213803 and 266946419581359002
INFO | 2018-06-04 09:26:46,449 | EvergreenWorker - starting createSuspects for 262352812954213903 and 266946419581359003

I wish to obtain the following result:

----------------------------------------------
suspect            |    altSuspect
----------------------------------------------
262352812954213803  |   266946419581359002
262352812954213903  |   266946419581359003
----------------------------------------------

i.e. The IDs obtained on the logs as suspect and altSuspect.

0 Karma
1 Solution

adonio
Ultra Champion

try this:

| makeresults count =1 
| eval data = " INFO | 2018-06-04 09:26:46,449 | EvergreenWorker - starting createSuspects for 262352812954213803 and 266946419581359002
 ;INFO | 2018-06-04 09:26:46,449 | EvergreenWorker - starting createSuspects for 262352812954213903 and 266946419581359003"
| makemv delim=";" data 
| mvexpand data
| rex field=data "for\s(?<suspect>\d+)\sand\s(?<altSuspect>\d+)"
| table suspect altSuspect

screenshot:
![alt text][1]

hope it helps

View solution in original post

adonio
Ultra Champion

try this:

| makeresults count =1 
| eval data = " INFO | 2018-06-04 09:26:46,449 | EvergreenWorker - starting createSuspects for 262352812954213803 and 266946419581359002
 ;INFO | 2018-06-04 09:26:46,449 | EvergreenWorker - starting createSuspects for 262352812954213903 and 266946419581359003"
| makemv delim=";" data 
| mvexpand data
| rex field=data "for\s(?<suspect>\d+)\sand\s(?<altSuspect>\d+)"
| table suspect altSuspect

screenshot:
![alt text][1]

hope it helps

Nidd
Path Finder

Thanks Adonio ! 🙂

0 Karma

Richfez
SplunkTrust
SplunkTrust

If it's not clear from the above, the piece you need, @Nidd, is to add after whatever search you have to return your rows...

| rex field=data "for\s(?<suspect>\d+)\sand\s(?<altSuspect>\d+)"
| table suspect altSuspect

Those two lines should extract your two fields then create a table out of them for you.

Happy Splunking!
-Rich

0 Karma

Nidd
Path Finder

Thank you Rich 🙂

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...