Splunk Search

Regex field extraction question

Explorer

Hi

I have this log format for extracting

Sep 01 09:55:11 @ipdest HSL: @ip1:port1 <-> @ip2:port2 | @ip3:port3 <-> @ip4:port4

REGEX = (?\S+\s+\d+ \d+:\d+:\d+) (?\d+.\d+.\d+.\d+)[^[]HSL: (?<@ip1>\d+.\d+.\d+.\d+):(?\S+) <-> (?<@ip2>\d+.\d+.\d+.\d+):(?\S+) | (?<@ip3>\d+.\d+.\d+.\d+):(?\S+) <-> (?<@ip4>\d+.\d+.\d+.\d+):(?\S+)

I would like to extract everything , but in my results, all fields were exctracted except whose after pipe | (@ip3:port3 <-> @ip4:port4).
Any help much appreciated.
Thankyou.

0 Karma
1 Solution

Champion

The | character acts as an OR in regex. If you would like to match a literal | escape it: \|.

REGEX = (?\S+\s+\d+ \d+:\d+:\d+) (?\d+.\d+.\d+.\d+)[^[]HSL: (?<@ip1>\d+.\d+.\d+.\d+):(?\S+) <-> (?<@ip2>\d+.\d+.\d+.\d+):(?\S+) \| (?<@ip3>\d+.\d+.\d+.\d+):(?\S+) <-> (?<@ip4>\d+.\d+.\d+.\d+):(?\S+)

View solution in original post

0 Karma

Champion

The | character acts as an OR in regex. If you would like to match a literal | escape it: \|.

REGEX = (?\S+\s+\d+ \d+:\d+:\d+) (?\d+.\d+.\d+.\d+)[^[]HSL: (?<@ip1>\d+.\d+.\d+.\d+):(?\S+) <-> (?<@ip2>\d+.\d+.\d+.\d+):(?\S+) \| (?<@ip3>\d+.\d+.\d+.\d+):(?\S+) <-> (?<@ip4>\d+.\d+.\d+.\d+):(?\S+)

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

You also better escape the periods in your IP addresses - \.. A period will match almost any character of not escaped. Depending on your data, that could be a problem, but likely in this case it won't. But it will parse more quickly if you escape them, which is a side benefit.

Explorer

Hello ,

Thank you, It works now,I added the \ before the |.

Meryem

0 Karma