Splunk Search
Highlighted

Regular Expression for Field Extract custom log

New Member

Hello,
Can anyone help me to extract some field as I need like POS CODE, POS NAME, POS ID with these value:
[POS CODE, POS NAME, POS ID]
[112044, GIA THỊNH , 9476]
[112044, GIA THỊNH , 9476]
.....

Can someone help me with regex to do this?

Any help is appreciated for me. Thanks.

2015-10-09 14:27:20,927 DEBUG com.nocldfr.com.bean.listhandler.ListHandlerBean - performSearch in the bean outside [4676, 234, [POS CODE, POS NAME, POS ID], [112044, GIA THỊNH , 9476], [605032, LÝ PHÚ NO, 9437], [1000165, MINH NGỌC ANH, 6271], [606073, THIÊN ANH , 9436], [135042, 282 QUANG TRUNG, 9743], [120095, 289 HÀ THÀNH, 7705], [604135, A LÀNHNO, 7987], [601144, A LÔ XINH, 8676], [604219, A MẠNH HIỀNNO, 9131], [622029, A. ĐẠT MOBILE, 8449], [624022, AGG - 188 Tôn Đức Thắng , 7606], [624002, AGG-243 Lê Lợi, 5749], [624008, AGG-244 Trần Hưng Đạo, 5910], [624001, AGG-311 Trần Hưng Đạo, 5669], [606077, ALO, 9583], [606079, ALO XINHNO, 9794], [614023, ALÔ MOBILENO, 8851], [133023, AN BIÊN 2, 1130], [627055, AN BÌNHNO, 9246], [125013, AN CHÂU CHƯƠNG 1, 676]]

Tags (2)
0 Karma
Highlighted

Re: Regular Expression for Field Extract custom log

SplunkTrust
SplunkTrust

Try something like this

your base search | rex field=_raw max_match=0 "\[(?<POS_CODE>\d+),\s*(?<POS_NAME>[^,]+),(?<POS_ID>\d+)\]" 
0 Karma
Highlighted

Re: Regular Expression for Field Extract custom log

New Member

Thanks somesoni2,

But this does not show any fields extract on this search:
index=cas | rex field=raw maxmatch=0 "[(?\d+),\s*(?[^,]+),(?\d+)]"

I tried to use Field Extraction but can not extract more values with the same Field name, So I need to use Regex.
I would like to extract 3 field according values i can see like this:
POS_CODE which is the first value on event: [112044, GIA THỊNH , 9476] [605032, LÝ PHÚ _NO, 9437] [1000165, MINH NGỌC ANH, 6271] ... and so on on the event

POS_NAME which is the second value on event: [112044, GIA THỊNH , 9476] [605032, LÝ PHÚ _NO, 9437] [1000165, MINH NGỌC ANH, 6271] ... and so on on the event

POS_ID which is the third value on the event: [112044, GIA THỊNH , 9476] [605032, LÝ PHÚ _NO, 9437] [1000165, MINH NGỌC ANH, 6271] ... and so on on the event

Thanks for your help

0 Karma