Splunk Search

Manual Edit of reg expressions in Field Extractions page

lehrfeld
Path Finder

I have been working with extracting userIDs using RegExs and have run into some trouble. The following returns the correct results

| rex field=_raw "\,[abc]\w\w\w\w\w\w(?<userID>)" | stats count(userID)

This extracts user IDs from a csv file (that is our sourcetype)

When I go to the Fields Extraction page and edit the extraction manually, I don't get any results (actually, it returns none found)

I have tried editing the inline regex to read \,[abc]\w\w\w\w\w\w(?) but it is not returning anything. I can't seem to find any documentation about the nuances of this inline regex. Any tips would be great!

Thanks, Mike

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

   | rex  "(,\s)* (?P<userID>\w\w\w\d\d\d\d)(,\s)*"

assumming userId format is 3 alphabet and 4 digits. Update this if necessary.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

   | rex  "(,\s)* (?P<userID>\w\w\w\d\d\d\d)(,\s)*"

assumming userId format is 3 alphabet and 4 digits. Update this if necessary.

0 Karma

lehrfeld
Path Finder

That is great! Thank you! Mike

lehrfeld
Path Finder

Thanks for the responses. I have a csv with information like email, userID, phone number, etc in it. A typical userID will be formatted like 'acb1234'. The issue that I am addressing is that the userID location between the various sourcetypes has changed over time. Meaning that in version one, the userID was in the second column, in version two, is has moved to the 8th column.

Sample entry would be
mike@email.com, abc1234, 555-555-1212, FName, LName ...
AND
21, mike@email.com, FName, LName, abc1234, 555-555-1212 etc..

Thank you! Mike

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Can you provide some sample entries?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

There may be some editing error, your userID capturing group cannot match anything because it's empty.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...