Splunk Search

Regular Expression if then else

jessicadrechsel
New Member

Hello everyone.

I have field which sometimes contains Profilename and Stepname and sometimes just the Profilename.
I would like to extract the profilename and stepname.

Example: Test_Profile-TestStep
Test_Profile is the profilename
TestStep is the stepname
It`s always combined with an -

So if there is no - then the whole field is the profilename.

I´m absolutely not confirm with regular expressions.

I`ve tried this

(?(?=\b-\b)(?P<ProfileStep>[^-"]+)|(?P<ProfileStep>[^"]+))

But splunk says "Regex: two named subpatterns have the same name"

I would be so happy about some help. 😄

Kind regards
Jessi

0 Karma

adonio
Ultra Champion

@jessicadrechsel,
looking at your data, it seems like you have key value pairs there for Profilename and Stepname. best will be to extract permanently with field extractor, also i would suggest to check your data in verbose mode as splunk is pretty good at understanding field=value structure.
in any case try the following:

 ... your search ... | rex "Profilename=(?<Profilename>\S+)" 
                               | rex "Stepname=(?<Stepname>\S+)"

hope it helps

0 Karma

jessicadrechsel
New Member

Got the problem solved for the profile name

(?J)(?(?=\b-\b)(?P<ProfileStep>[^"]+)|(?P<ProfileStep>[^-"]+))

Now I try to figure it out for the stepname

(?J)(?(?=\b-\b)(?+[^-"]P<Stepname>)|(?+[^"]P<Stepname>))      <== not working
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Can you please try below regex

(?<Profilename>\w+)[\-]?(?<Profilestep>.*)

If you want to test this regex then please check https://regex101.com/r/3XdfSv/2

0 Karma

jessicadrechsel
New Member

Thats not working. 😞

For example a whole line - with stepname - looks like that:
2018-04-13 08:13:51,"germany","e2e_appmon","GEV_Muenchen_DE_MU_X2SLM39","DE_MU_X2SLM39","GEV_ADPortal-Zusatzdaten_erfassen",2018-04-13 08:13:50,763,"QOS_E2E_EXECUTION"
Profilename=GEV_ADPortal
Stepname=Zusatzdaten_erfassen

A line without stepname looks like that:
2018-04-13 08:13:51,"germany","e2e_appmon","GEV_Muenchen_DE_MU_X2SLM39","DE_MU_X2SLM39","GEV_ADPortal",2018-04-13 08:13:50,763,"QOS_E2E_EXECUTION"
Profilename=GEV_ADPortal
Stepname= or if this is not possible then I can write the profilename in stepname

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...