Splunk Search

Matching Two Strings in Field Extraction

kederart
Explorer

I am trying to match two separate strings for one field extraction. When setup separately they would look like...

(?i)^[^*#\d+\s+(?P< a >[^]+)

and

(?i)^(?:[^\-]*\i{2}\d+\s+(?P< b >[^]+)

I combined them by simply placing a pipe in between the two strings. The problem is Splunk will only pick up whichever value has a, and the b value will be lost. I can switch a and b and the values picked up will switch, but I cannot get the combination of both. I also cannot name both a as that is against Splunk conventions. Is this possible to accomplish? What am I missing here? Thanks.

Tags (1)
0 Karma
1 Solution

jameshgibson
Path Finder

can you not change the regex to:

(?i)^([^*#]\d+\s+|(?:)[^\-]*\i{2}\d+\s+)(?P<a>[^]+)

this should match (?P<a>[^]+) when preceded by either (?i)^[^*#]\d+\s+ or (?i)^(?:)[^\-]*\i{2}\d+\s+

that is assuming you are missing a closing [ and ) in the expressions in your question.

View solution in original post

Ayn
Legend

Fair enough, but I think the easiest thing still would be to have multiple field extractions - you can still use the same field name for your extraction, it's just different ways of arriving at the extracted field. So you wouldn't have to mess with name1, name2 etc, you can just extract everything to name.

0 Karma

jameshgibson
Path Finder

can you not change the regex to:

(?i)^([^*#]\d+\s+|(?:)[^\-]*\i{2}\d+\s+)(?P<a>[^]+)

this should match (?P<a>[^]+) when preceded by either (?i)^[^*#]\d+\s+ or (?i)^(?:)[^\-]*\i{2}\d+\s+

that is assuming you are missing a closing [ and ) in the expressions in your question.

kederart
Explorer

Sorry for the confusion. We want to search for a name (example a), however the name isn't always coming up as other names are being formatted in the second way (example b). We want a way to search for all the names without having multiple field extractions. I thought we could do that by piping the two searches together. We don't want to have name1, name2, name3 for field extractions because it's going to become cluttered and a little difficult to manage. Does that make more sense?

0 Karma

Ayn
Legend

I'm not sure I follow. Why would you need multiple searches to perform multiple field extractions? There are usually loads of field extractions taking place for each event in a search.

0 Karma

kederart
Explorer

We have a dozen or so logs and we are doing multiple field extractions for each log. If we keep doing multiple field extraction for "a" then we are going to be cluttered with 6-10 searches per log. Our goal is to cut down on the clutter.

0 Karma

Ayn
Legend

Why not have two field extractions?

0 Karma

kederart
Explorer

The only solution I've found so far is adding a second field extraction that both search on a. However, we have multiple logs and this could get cluttered when we start adding more searches. Would prefer to keep it as one search.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...