Splunk Search

Regex for field extraction with or without comma

magriii
Explorer

I found that the format of a sourcetype had changed some time ago.
Now I need to extract the data correctly for both cases.

 

2022-01-11 17:40:59.000, SEVERITY="123", DESCRIPTION="ooops"
2018-01-24 16:35:05 SEVERITY="112", DESCRIPTION="blabla"

 

Extraction for the first type of entries works with this regex that was build with splunk field extraction

 

^(?P<dt>[^,]+)[^"\n]*"(?P<SEVERITY>\d+)[^=\n]*="(?P<DESCRIPTION>[^"]+)

 

How can the regex be expanded to split either at "," or at the second space, if the comma is missing?

An idea is to capture always at the second space and remove the comma or split before SEVERITY and remove the comma. I didn't get either working.

You can find the regex at https://regex101.com/r/mxdAyx/1 

Thanks

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
^(?P<dt>[^ ]+ [^ ,]+)[^"\n]*"(?P<SEVERITY>\d+)[^=\n]*="(?P<DESCRIPTION>[^"]+)
0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...