Splunk Search

Regular Expression if then else

New Member

Hello everyone.

I have field which sometimes contains Profilename and Stepname and sometimes just the Profilename.
I would like to extract the profilename and stepname.

Example: Test_Profile-TestStep
Test_Profile is the profilename
TestStep is the stepname
It`s always combined with an -

So if there is no - then the whole field is the profilename.

I´m absolutely not confirm with regular expressions.

I`ve tried this


But splunk says "Regex: two named subpatterns have the same name"

I would be so happy about some help. 😄

Kind regards

0 Karma

Ultra Champion

looking at your data, it seems like you have key value pairs there for Profilename and Stepname. best will be to extract permanently with field extractor, also i would suggest to check your data in verbose mode as splunk is pretty good at understanding field=value structure.
in any case try the following:

 ... your search ... | rex "Profilename=(?<Profilename>\S+)" 
                               | rex "Stepname=(?<Stepname>\S+)"

hope it helps

0 Karma

New Member

Got the problem solved for the profile name


Now I try to figure it out for the stepname

(?J)(?(?=\b-\b)(?+[^-"]P<Stepname>)|(?+[^"]P<Stepname>))      <== not working
0 Karma


Can you please try below regex


If you want to test this regex then please check https://regex101.com/r/3XdfSv/2

0 Karma

New Member

Thats not working. 😞

For example a whole line - with stepname - looks like that:
2018-04-13 08:13:51,"germany","e2e_appmon","GEV_Muenchen_DE_MU_X2SLM39","DE_MU_X2SLM39","GEV_ADPortal-Zusatzdaten_erfassen",2018-04-13 08:13:50,763,"QOS_E2E_EXECUTION"

A line without stepname looks like that:
2018-04-13 08:13:51,"germany","e2e_appmon","GEV_Muenchen_DE_MU_X2SLM39","DE_MU_X2SLM39","GEV_ADPortal",2018-04-13 08:13:50,763,"QOS_E2E_EXECUTION"
Stepname= or if this is not possible then I can write the profilename in stepname

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!