Splunk Search

Regex for field extraction with or without comma

magriii
Explorer

I found that the format of a sourcetype had changed some time ago.
Now I need to extract the data correctly for both cases.

 

2022-01-11 17:40:59.000, SEVERITY="123", DESCRIPTION="ooops"
2018-01-24 16:35:05 SEVERITY="112", DESCRIPTION="blabla"

 

Extraction for the first type of entries works with this regex that was build with splunk field extraction

 

^(?P<dt>[^,]+)[^"\n]*"(?P<SEVERITY>\d+)[^=\n]*="(?P<DESCRIPTION>[^"]+)

 

How can the regex be expanded to split either at "," or at the second space, if the comma is missing?

An idea is to capture always at the second space and remove the comma or split before SEVERITY and remove the comma. I didn't get either working.

You can find the regex at https://regex101.com/r/mxdAyx/1 

Thanks

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
^(?P<dt>[^ ]+ [^ ,]+)[^"\n]*"(?P<SEVERITY>\d+)[^=\n]*="(?P<DESCRIPTION>[^"]+)
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...