Splunk Search

Why am I getting different results for this field extraction?

daniel333
Builder

All,

When I search and use rex I get the ports from the Apache logs as expected. Getting all ports 80 and 443 and 8080.
index=web 443 | rex field=_raw "^\d+.\d+.\d+.\d+ - (?\d+) ["

How ever, when I place the same extraction in props.conf it only gets port 80
[apache:access]
EXTRACT-port = ^\d+.\d+.\d+.\d+ - (?\d+) [

Any idea where my mistake is?

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Try:

EXTRACT-port = ^\d+\.\d+\.\d+\.\d+ - (?P<port>\d+) \[
0 Karma

skoelpin
SplunkTrust
SplunkTrust

The field is relative to the sourcetype you specify. Try explicitly including the sourcetype you defined in your props.conf in your search and see if you get the same results

0 Karma

DalJeanis
Legend

Your regexes look wrong to me.

Remember a period matches ANYTHING. If you mean only a . character, then you need to escape it.

so, for instance, matching this regex up with the IP that follows it...

 ^\d+.\d+.\d+.\d

 123.123.33.12

...means that the first \d+ matches the 1, the . matches the 2, the second \d+ matches the 3, the second . matches the first ., and so on.

Escape all those periods and try your test again.

0 Karma

niketn
Legend

@daniel333, Can you post your code with code button 101010 on Splunk Answers so that special characters do not escape?

Also can you add few mocked up sample events with different port numbers?

Ideally if rex is working in search, then same regular expression should also fetch when saved as Field Extraction (?<port>\d+).

Can you try Interactive Field Extraction in Splunk with your regular expression and see if you have Non Matches, or maybe let Splunk generate the regular expression, by adding non-matches.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...