Splunk Search

Repeating pattern in rex

stwong
Communicator

Hi all,

I'm trying to get the string after the 3rd colon in following log entry using

rex "^([^:]+:){3,3}(?P<uastring>.+)$"

mod=http request|cli=192.169.209.46/55465|srv=192.168.160.233/8983|subj=cli|app=MSIE 8 or newer|lang=Chinese|params=dishonest|raw_sig=1:Accept=[image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5],?Referer,Accept-Language=[zh-HK],User-Agent,Accept-Encoding=[gzip, deflate],Host,DNT=[1],Connection=[Keep-Alive],?Authorization:Accept-Charset,Keep-Alive:Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Geck

However, uastring returns string after the first colon. Would anyone please help?

Sorry for the newbie question. Thanks.

Regards

Tags (2)
0 Karma

stwong
Communicator

oops, colon in the timestamp counts:

[2014/05/07 16:18:46] mod=http request|cli=192.168.182.33/32959|srv=192.168.84.7/80|subj=cli|app=???|lang=English|params=none|raw_sig=1:Host,Connection=[keep-alive],?Cache-Control,Accept=[text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8],User-Agent,?Referer,Accept-Encoding=[gzip,deflate,sdch],Accept-Language=[en-US,en;q=0.8,zh-CN;q=0.6]:Accept-Charset,Keep-Alive:Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36

It works after matching the leading timestamp field. Sorry for my carelessness. Thanks.

Rgds

0 Karma

stwong
Communicator

Got it. Thanks a lot.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yeah, that's expected behaviour - despite being parsed at index time the time stamp remains part of the event.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Running this:

| stats count | eval _raw = "mod=http request|cli=192.169.209.46/55465|srv=192.168.160.233/8983|subj=cli|app=MSIE 8 or newer|lang=Chinese|params=dishonest|raw_sig=1:Accept=[image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5],?Referer,Accept-Language=[zh-HK],User-Agent,Accept-Encoding=[gzip, deflate],Host,DNT=[1],Connection=[Keep-Alive],?Authorization:Accept-Charset,Keep-Alive:Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Geck" | rex "^([^:]+:){3,3}(?P<uastring>.+)$"

Gives me uastring="Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Geck" which seems ok.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...