Splunk Search

REGEX extract field at certain position

Explorer

I am attempting to extract fields from a file which was created to be human readable, so it has fields aligned at certain column numbers throughout. I wrote a regular expression to get a digit character at a specific column number and extract that to the lvl field. The actual expression is

(?<=^.{54})([0-9])

This expression works without the field specification in Notepad++ for a search within the file that I'm trying to extract fields from in Splunk, but it doesn't find any suitable field values when used in the rex command or in Field Extraction. I figured this was a difference in syntax for PCRE regexes, or that there is a multiline specification that I'm missing. Adding a \m to the regex did not seem to do the trick.

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

This worked for me in regex101.com using your sample input.

"(?mg)^.{55}(?<lvl>[0-9])"

I've abandoned the field extractor as it seems to rarely work well for me.

---
If this reply helps you, an upvote would be appreciated.

SplunkTrust
SplunkTrust

Try testing your expressions at https://www.regex101.com/. It supports PCRE expressions.
If you post a sample of your input here someone may be able to spot where you've made an error.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer
SSN         Emplid  Employee Name                     Lvl   Field Name                       Field Value                      Err#   Error Description                                                                  Resp   Position

xxxxxxxxx   xxxxxx  Testy, Tester A                   2     Organization                     testval                          0086   Organization is blank or invalid                                                   L      testval                       
xxxxxxxxx   xxxxxx  Testname, Test                    2     Organization                     testval                          0086   Organization is blank or invalid                                                   L      testval                       
xxxxxxxxx   xxxxxx  Testerman, Testly                 2     Organization                     testval                          0086   Organization is blank or invalid                                                   L      testval  

Here is the input sample I used, and the exact expression the tester used is

/(?<=^.{54})([0-9])/mg

Now I added the global modifier - the /g, and it did find all of the field values I was expecting. This regex still is not working in the Field Extractor or with the rex command, when I input it exactly as shown above.

0 Karma

Explorer

Sorry - note the version I'm using in Splunk is

/(?<lvl><=^.{54})([0-9])/mg

to specify that I want the result to be put in the lvl field.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!