Splunk Search

Regex to print 7th word of a one if a particular condition is met

saranyaa21
Path Finder

Hi ,

below is the sample data :

12:10:32,946 INFO [class_name] [IP address] [id1] [-] [null,null,null,null,null,null,pincode] Logged in.
12:10:32,968 INFO [class_name] [IP address] [id1] [-] [name,id,location,street,state,country,pincode] Performing activity.

I'm trying to print the class name if 6th word is [-] and 7th word contains null values in it.

I'm using the following regex to do so:
rex field=_raw "(^(?:\S+\s+){2})(?<"Class_name">(\S+))" |rex field=_raw "(?<"Details">(?<=[-]\s[null).*pincode])"'

My challenge here:
This regex only captures the class_name and null,null,null,null,null,null,pincode . Actually, the same class has already printed the details for the same id id1 in a different place.

How should I correct my regular expression, in order to check, if the class has already printed the details, and to skip that class from the collection of empty details printing class list .

Thanks in advance .

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Can you please try this?

YOUR_SEARCH | rex field=_raw "(^(?:\S+\s+){2})\[(?<Class_name>(\S+))\]"  |rex field=_raw "(?<Details>(\[-\]\s\[null.*pincode]))" | dedup Class_name

My Sample Search:

| makeresults | eval d="12:10:32,946 INFO [class_name] [IP address] [id1] [-] [null,null,null,null,null,null,pincode] Logged in.||12:10:32,968 INFO [class_name] [IP address] [id1] [-] [name,id,location,street,state,country,pincode] Performing activity." | eval d=split(d,"||") | mvexpand d | eval _raw=d | fields _raw | rex field=_raw "(^(?:\S+\s+){2})\[(?<Class_name>(\S+))\]"  |rex field=_raw "(?<Details>(\[-\]\s\[null.*pincode]))" | dedup Class_name

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Can you please try this?

YOUR_SEARCH | rex field=_raw "(^(?:\S+\s+){2})\[(?<Class_name>(\S+))\]"  |rex field=_raw "(?<Details>(\[-\]\s\[null.*pincode]))" | dedup Class_name

My Sample Search:

| makeresults | eval d="12:10:32,946 INFO [class_name] [IP address] [id1] [-] [null,null,null,null,null,null,pincode] Logged in.||12:10:32,968 INFO [class_name] [IP address] [id1] [-] [name,id,location,street,state,country,pincode] Performing activity." | eval d=split(d,"||") | mvexpand d | eval _raw=d | fields _raw | rex field=_raw "(^(?:\S+\s+){2})\[(?<Class_name>(\S+))\]"  |rex field=_raw "(?<Details>(\[-\]\s\[null.*pincode]))" | dedup Class_name
0 Karma

saranyaa21
Path Finder

Hello @kamlesh_vaghela ,

Your sample search works, as expected. But how do I use my search, to combine different pieces of logs as you have done in

| makeresults | eval d="12:10:32,946 INFO [class_name] [IP address] [id1] [-] [null,null,null,null,null,null,pincode] Logged in.||12:10:32,968 INFO [class_name] [IP address] [id1] [-] [name,id,location,street,state,country,pincode] Performing activity." | eval d=split(d,"||") | mvexpand d | eval _raw=d | fields _raw | rex field=_raw "(^(?:\S+\s+){2})[(?(\S+))]" |rex field=_raw "(?([-]\s[null.*pincode]))" | dedup Class_name

0 Karma

saranyaa21
Path Finder

In this query below since two line, it was explicitly mentioned for comparison. But how do I compare huge logs when I don't know what will be the log entry.

| makeresults | eval d="12:10:32,946 INFO [class_name] [IP address] [id1] [-] [null,null,null,null,null,null,pincode] Logged in.||12:10:32,968 INFO [class_name] [IP address] [id1] [-] [name,id,location,street,state,country,pincode] Performing activity." | eval d=split(d,"||") | mvexpand d | eval _raw=d | fields _raw | rex field=_raw "(^(?:\S+\s+){2})[(?(\S+))]" |rex field=_raw "(?([-]\s[null.*pincode]))" | dedup Class_name

should I try something like,

| makeresults | eval d="sourcetype=serverlog||sourcetype=serverlog | eval d=split(d,"||") | mvexpand d | eval _raw=d | fields _raw | rex field=_raw "(^(?:\S+\s+){2})[(?(\S+))]" |rex field=_raw "(?([-]\s[null.*pincode]))" | dedup Class_name

How should I pass the raw field here , the entire logs here ?!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@saranyaa21

You have to use below portion of search with your event, Like if your events are in abc index and xyz sourcetype the your search should be like below

index=abc sourcetype=xyz  | rex field=_raw "(^(?:\S+\s+){2})[(?(\S+))]" |rex field=_raw "(?([-]\s[null.*pincode]))" | dedup Class_name

saranyaa21
Path Finder

Dedup worked. Thanks @kamlesh_vaghela

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Gald to help you @saranyaa21. Can you please accept this answer to close this question?

0 Karma

saranyaa21
Path Finder

done Kamlesh

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...