Hello everyone.
I have field which sometimes contains Profilename and Stepname and sometimes just the Profilename.
I would like to extract the profilename and stepname.
Example: Test_Profile-TestStep
Test_Profile is the profilename
TestStep is the stepname
It`s always combined with an -
So if there is no - then the whole field is the profilename.
I´m absolutely not confirm with regular expressions.
I`ve tried this
(?(?=\b-\b)(?P<ProfileStep>[^-"]+)|(?P<ProfileStep>[^"]+))
But splunk says "Regex: two named subpatterns have the same name"
I would be so happy about some help. 😄
Kind regards
Jessi
@jessicadrechsel,
looking at your data, it seems like you have key value pairs there for Profilename and Stepname. best will be to extract permanently with field extractor, also i would suggest to check your data in verbose mode as splunk is pretty good at understanding field=value
structure.
in any case try the following:
... your search ... | rex "Profilename=(?<Profilename>\S+)"
| rex "Stepname=(?<Stepname>\S+)"
hope it helps
Got the problem solved for the profile name
(?J)(?(?=\b-\b)(?P<ProfileStep>[^"]+)|(?P<ProfileStep>[^-"]+))
Now I try to figure it out for the stepname
(?J)(?(?=\b-\b)(?+[^-"]P<Stepname>)|(?+[^"]P<Stepname>)) <== not working
Can you please try below regex
(?<Profilename>\w+)[\-]?(?<Profilestep>.*)
If you want to test this regex then please check https://regex101.com/r/3XdfSv/2
Thats not working. 😞
For example a whole line - with stepname - looks like that:
2018-04-13 08:13:51,"germany","e2e_appmon","GEV_Muenchen_DE_MU_X2SLM39","DE_MU_X2SLM39","GEV_ADPortal-Zusatzdaten_erfassen",2018-04-13 08:13:50,763,"QOS_E2E_EXECUTION"
Profilename=GEV_ADPortal
Stepname=Zusatzdaten_erfassen
A line without stepname looks like that:
2018-04-13 08:13:51,"germany","e2e_appmon","GEV_Muenchen_DE_MU_X2SLM39","DE_MU_X2SLM39","GEV_ADPortal",2018-04-13 08:13:50,763,"QOS_E2E_EXECUTION"
Profilename=GEV_ADPortal
Stepname= or if this is not possible then I can write the profilename in stepname