Splunk Search

What is the proper regex syntax to use rex to create 4 new fields?

akelly4
Path Finder

I have a log line that looks like the following:

2014-11-28 19:28:42 smx02 postfix/smtp[57736]: 6F7471C73AC_479133AF: to=, relay=127.0.0.1[127.0.0.1]:10025, delay=0.13, delays=0.01/0/0/0.12, dsn=2.0.0, status=sent (250 OK, sent 5479133A_6994_12793_1 8E560172844_479133AB)

I want to use regex to create 4 new fields.

Field1 - 6F7471C73AC_479133AF (number/letter combinations)
Field2 - 5479133A_6994_12793_1 (number/letter combinations)
Field3 - 8E560172844_479133AB (number/letter combinations)
Field 4 - 57736 (Always number)

I know I can use the rex field=FIELDNAME command, but I can't seem to get the syntax to work.

Is there anyone that can point me in the right direction or give me some times on how to create these fields. I really just want to understand the Splunk syntax.

Tags (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

For problems like this, RegExr is a great tool. Using it and your sample event, I came up with this.

rex "\[(?<Field4>\d+)]:\s+(?<Field1>\S+):[\s\S]+?, sent (?<Field2>\S+) (?<Field3>\S+)"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

abhay1991
New Member

/apps/IHSLogs/com-ihs85-pd01-01/IRXWebCommon/access_log_2018-11-16

how to extract this field

0 Karma

ppablo
Retired

Also, here's a previous Answers posts with a collection of users' favorite resources for regex help 🙂

http://answers.splunk.com/answers/153171/is-there-any-online-regex-tool-to-create-regular-e.html

0 Karma

richgalloway
SplunkTrust
SplunkTrust

For problems like this, RegExr is a great tool. Using it and your sample event, I came up with this.

rex "\[(?<Field4>\d+)]:\s+(?<Field1>\S+):[\s\S]+?, sent (?<Field2>\S+) (?<Field3>\S+)"
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...