Splunk Search

Regular Expression if then else

New Member

Hello everyone.

I have field which sometimes contains Profilename and Stepname and sometimes just the Profilename.
I would like to extract the profilename and stepname.

Example: Test_Profile-TestStep
Test_Profile is the profilename
TestStep is the stepname
It`s always combined with an -

So if there is no - then the whole field is the profilename.

I´m absolutely not confirm with regular expressions.

I`ve tried this

(?(?=\b-\b)(?P<ProfileStep>[^-"]+)|(?P<ProfileStep>[^"]+))

But splunk says "Regex: two named subpatterns have the same name"

I would be so happy about some help. 😄

Kind regards
Jessi

0 Karma

SplunkTrust
SplunkTrust

@jessicadrechsel,
looking at your data, it seems like you have key value pairs there for Profilename and Stepname. best will be to extract permanently with field extractor, also i would suggest to check your data in verbose mode as splunk is pretty good at understanding field=value structure.
in any case try the following:

 ... your search ... | rex "Profilename=(?<Profilename>\S+)" 
                               | rex "Stepname=(?<Stepname>\S+)"

hope it helps

0 Karma

New Member

Got the problem solved for the profile name

(?J)(?(?=\b-\b)(?P<ProfileStep>[^"]+)|(?P<ProfileStep>[^-"]+))

Now I try to figure it out for the stepname

(?J)(?(?=\b-\b)(?+[^-"]P<Stepname>)|(?+[^"]P<Stepname>))      <== not working
0 Karma

SplunkTrust
SplunkTrust

Can you please try below regex

(?<Profilename>\w+)[\-]?(?<Profilestep>.*)

If you want to test this regex then please check https://regex101.com/r/3XdfSv/2

0 Karma

New Member

Thats not working. 😞

For example a whole line - with stepname - looks like that:
2018-04-13 08:13:51,"germany","e2e_appmon","GEV_Muenchen_DE_MU_X2SLM39","DE_MU_X2SLM39","GEV_ADPortal-Zusatzdaten_erfassen",2018-04-13 08:13:50,763,"QOS_E2E_EXECUTION"
Profilename=GEV_ADPortal
Stepname=Zusatzdaten_erfassen

A line without stepname looks like that:
2018-04-13 08:13:51,"germany","e2e_appmon","GEV_Muenchen_DE_MU_X2SLM39","DE_MU_X2SLM39","GEV_ADPortal",2018-04-13 08:13:50,763,"QOS_E2E_EXECUTION"
Profilename=GEV_ADPortal
Stepname= or if this is not possible then I can write the profilename in stepname

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!