Splunk Search

Regex Help

darkins
Engager

probably a basic question

i have the following data 

600 reason

and this rex

(?<MetricValue>([^\s))]+))(?<Reason>([^:|^R]+))

what i am getting is 60 in Metric Value and 0 in Reason

i presume that is due to the match being up to the next NOT space, thus metric value is 60 and 0 remains in the data for Reason

what is the right way to do this such that i get value = 600 and reason = reason

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Given the complexity of the regex, I suspect the sample event may be over-simplified.  However, if it's a matter of the value field is an integer followed by a space then everything goes into the reason field then this rex command will do.

| rex "(?<MetricValue>\d+)\s(?<Reason>.*)"

 

---
If this reply helps you, Karma would be appreciated.

dural_yyz
Builder

Actually most of your problem is coming from multiple capture groups inside a capture group designated by each "()" pairing.

 

| makeresults format=csv data="sample
600 reason and more:then what
701 code practice Reason
899 something
104 this
12 nothing"
| rex field=sample "^(?<Metric>[^\s]+)\s(?<Reason>[^:|^R]+).*$"
| table sample Metric Reason

 

You can see in my example that after the <field> I did not nest additional capture group designations such as what you were using.  The above generates some random data which I hope fits your use case but you provided minimal examples so I made assumptions.  The rex as coded would with draw the information you are looking for assuming that the Metric is the first one the line or field and following that is the Reason with your indicated cut off characters or end of line like I indicated.  Feel free to remove the indicators for beginning of line and end of line if they don't fit your data.

Here is the output I get.

sampleMetricReason
600 reason and more:then what600reason and more
701 code practice Reason701code practice
899 something899something
104 this104this
12 nothing12nothing

 

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...