Splunk Search

Two possible Prefix for my regular expression for field extraction

tallasky
Explorer

Hello,

I would like to know if it's possible to use the OR | or any other solution to use two possible prefix in my Regex while extrating field values.

Exemple:
I have the following data

a) Time1 WARN some message here

b) Time2 ERROR /r7/ some other message

c) Time3 FATAL /r3/ yet another message

and i want the word after WARN, ERROR /r7/ and FATAL /r3/

So here i did (?i)(?:WARN|ERROR./r[0-9]/|FATAL./r[0-9]/)(?[^ ]+)
but it's not working, opposed to (?i)(?:WARN|ERROR|FATAL)(?[^ ]+) whitch works.
Is it possible to have a regex instead of the word after the pipe (|) charater?

Thank you.

tallasky
Explorer

Hello somesoni2, I got an error using you regex but this worked for me:

(?i) (?:Asset |video ./r[0-9]/C*C*U*R*!)(?P[^ ,]+)

Note: Spacing is Important! and Depends on how your data is presented of course. Thank you.

0 Karma

tallasky
Explorer

Note: CCUR! is part of my data and not a RegEx function.

0 Karma

somesoni2
Revered Legend

Can you try below regex

"(WARN|ERROR /r[0-9]/|FATAL /r[0-9]/) (?<your_field>.*)"
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...