Splunk Search

How to write regex to extract a string, but ignore the last portion if a certain string is present?

Explorer

Hi All,

Below are the two different events we have,

1) DateTime="2014-11-04 06:42:35" SourceFile=ABCD.EFGH.IJKL.ABCTFILE DestFile=XYZA.R160001B.WERT10.A0005.H0001B00
2) DateTime="2014-11-04 06:41:35" SourceFile=XYZA.ER5678A.WERT10.T0005.J0001B00 DestFile=XYZA.R160001B.WERT10.A0005.H0001B00

We need to extract the string which is highlighted in BOLD from SourceFile. The rule is to ignore the complete word where "BOO" is present in end of the string(In 2nd event "J0001B00") or extract complete string if "BOO" is not present (in 1st Event)

We wrote a regEx which will match ---> (?i)SourceFile\W(.?).\w+\s
*
ABCD.EFGH.IJKL** from 1st event ==> here "ABCTFILE" is missing
XYZA.ER5678A.WERT10.T0005 from 2nd event

We have issues in extracting from 1st event.

Online RegEx Editor with above Events
http://rubular.com/r/O6tB73XSpz
Can any one please help to write proper regEx which will extract both string

Thanks,
Smith

1 Solution

Motivator

Hello

Try with this regex:

SourceFile\=(?<yourfield>(\w+|\.){7})(\sDestFile|\.\w*B00\s)

Regards

View solution in original post

Motivator

Hello

Try with this regex:

SourceFile\=(?<yourfield>(\w+|\.){7})(\sDestFile|\.\w*B00\s)

Regards

View solution in original post

Contributor

If the format of the filename is not a fixed number of period separated names, you could use something like

SourceFile\=(?P<yourfield>(\w+|\.)+?)(|\.\w*B00)\sDestFile\=
0 Karma