Splunk Search

Two possible Prefix for my regular expression for field extraction

tallasky
Explorer

Hello,

I would like to know if it's possible to use the OR | or any other solution to use two possible prefix in my Regex while extrating field values.

Exemple:
I have the following data

a) Time1 WARN some message here

b) Time2 ERROR /r7/ some other message

c) Time3 FATAL /r3/ yet another message

and i want the word after WARN, ERROR /r7/ and FATAL /r3/

So here i did (?i)(?:WARN|ERROR./r[0-9]/|FATAL./r[0-9]/)(?[^ ]+)
but it's not working, opposed to (?i)(?:WARN|ERROR|FATAL)(?[^ ]+) whitch works.
Is it possible to have a regex instead of the word after the pipe (|) charater?

Thank you.

tallasky
Explorer

Hello somesoni2, I got an error using you regex but this worked for me:

(?i) (?:Asset |video ./r[0-9]/C*C*U*R*!)(?P[^ ,]+)

Note: Spacing is Important! and Depends on how your data is presented of course. Thank you.

0 Karma

tallasky
Explorer

Note: CCUR! is part of my data and not a RegEx function.

0 Karma

somesoni2
Revered Legend

Can you try below regex

"(WARN|ERROR /r[0-9]/|FATAL /r[0-9]/) (?<your_field>.*)"
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...