Splunk Search

OR (|) condition in regular expression

Builder

I am missing something in my regular expression
I am having similar log and I can do with two regex but I want to combine all search in single regex.

Here is my 2 log events

I20121126 16:50:50.949136  7416 r_c.cpp:42] TTT.OUT.MESSAGE:121 [R10] [LOG-SG1/REPORT.PRINT.SOD-EB.EOD.REPORT.PRINT] [T24.System.Metrics] READ.SIZE#HMLL1107506#26 NOV 2012#16:50:51#1#F.STANDARD.SELECTION#FD.FID.ORDER#INT#EB.EOD.REPORT.PRINT#7852#0#4

I20121126 16:57:22.375921  7416 r_c.cpp:42] TTT.IN.MESSAGE:121 [R10] [LOG-SG1/BATCH.DATE.RESET-BATCH.DATE.RESET] [T24.System.Metrics] JOB.STARTED#HMLL1107506#26 NOV 2012#16:57:22#1#O999#SG0010001_20120131-SG1/BATCH.DATE.RESET_BATCH.DATE.RESET_1#DailyRollingOTCCRAN.SY1202601307#BATCH.DATE.RESET#1#0#4

Here is my regex

\[[\w]{0,}-{0,1}(?P<CompanyName>\w\w\w)[^\s]+\s\[(?P<RecordType>[\w\.]{0,})\]\s(?P<JobStatus>[^#]+)#(?P<ServerName>[^#]+)#(?P<ServerDate>[^#]+)#(?P<ServerTime>[^#]+)#(?P<MetricsCount>[^#]+)#(?P<Stage>\w{0,1})(?P<ItemDetail>\d{0,3})|(?P<ItemDescription>[^#]+)#(?P<TopKey>[^#]+)#(?P<TransactionRef>[^#]{0,})#(?P<Application>[^#]{0,})#(?P<ResponseTime>\d+)#(?P<Unused>\d)#(?P<PortNumber>\d)

above regex will select only one event
something wrong here

**(?P<Stage>\w{0,1})(?P<ItemDetail>\d{0,3})|(?P<ItemDescription>[^#]+)**

can you please tell me what I am missing?

Tags (2)
0 Karma
Highlighted

Re: OR (|) condition in regular expression

Splunk Employee
Splunk Employee

Not sure if you can use an OR to extract one field of another.
usually this is the opposite, you have one field with 1 value or another.

try to do in 2 steps

 rex "(?((\d{0,3})|([^#]+))

then an eval with conditions to extract the fields ItemDetail OR the field ItemDescription from the field ItemAll.

Highlighted

Re: OR (|) condition in regular expression

SplunkTrust
SplunkTrust

It is possible to have a | between fields in rex, it'll extract the first field that matches - even if the second one would have matched as well.

Not sure if this is what the OP wants though, it's not a logical OR in the sense of "this, that, or both" but rather a "this if it exists, else that if it exists, else neither" 😄

0 Karma
Highlighted

Re: OR (|) condition in regular expression

Influencer

You can use OR in regex, you just need to group the options together in a non-capturing group

i.e.

(?:(?P<ItemDetail>\d{0,3})|(?P<ItemDescription>[^#]+))

This will set ItemDescription in the 1st example log.

You might prefer

(?:(?P<ItemDetail>\d{0,3})|\.(?P<ItemDescription>[^#]+))

If you want to strip the '.' after Stage ( F in the 1st example ) as it sticks to the front of the ItemDescription