Splunk Search

Interactive Field Extraction (IFX) (Regex)

kailun92
Communicator

Original message <d:Message>(22/7)17:53 Accident on AYE (towards Tuas) after Jurong Port Rd Exit. Avoid lanes 2 and 3.</d:Message>

My XML at here Xml Data. How to extract all the exits only (e.g. Jurong Port Rd Exit) ?

I needed all the accident extracted by generated regex expression Interactive Field Extraction (IFX) feature

I am currently using Generated pattern (regex) of (?i)Area>(?P[^<]+).
It extracted this:

alt text

Tags (2)
0 Karma
1 Solution

paddygriffin
Path Finder

you can modify the generated regex in Manager>Fields>Field Extractions, or better to make a new one using the existing one as a starting point [don't forget to also change the field name in the updated regex].
If I'm interpreting your goal correctly [extract exit name], one way would be to provide more context pattern in the regex, so for example it looks like each exit name is always preceded by before | till | at | beyond [maybe others] and ends with Exit. and you want to extract all characters between those two patterns.

View solution in original post

bmacias84
Champion

probably little more that you wanted. I cant see the XML since its blocked for me.


<d:Message>\(\d+/\d+\)\d\d:\d\d\s(?<eventtype>[^\s]+)\son\s(?<location>[^\(]+)\s\((?<direction>[^\)]+)\)\safter\s(?<area>[^\.]+)

If your useing IFX might looks something like this.

<d:Message>\(\d+/\d+\)\d\d:\d\d\s(?<field1>[^\s]+)\son\s(?<field2>[^\(]+)\s\((?<field3>[^\)]+)\)\safter\s(?<field4>[^\.]+)

The return fields:

  • eventtype=Accident
  • location=Aye
  • direction=toward Tuas
  • area=Jurong Port Rd Exit

I've tested it with the sample give above.

Hope this helps or gets you started.

paddygriffin
Path Finder

you can modify the generated regex in Manager>Fields>Field Extractions, or better to make a new one using the existing one as a starting point [don't forget to also change the field name in the updated regex].
If I'm interpreting your goal correctly [extract exit name], one way would be to provide more context pattern in the regex, so for example it looks like each exit name is always preceded by before | till | at | beyond [maybe others] and ends with Exit. and you want to extract all characters between those two patterns.

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...