Splunk Search

Why isn't regex101 to Splunk rex translation insertion working?

Steve_A200
Path Finder

Hi,

I managed to get my regex101 expression working, however, I am not able to get it working in splunk.  I would like to extract only the location ID's that are listed in the _raw if they are preceded with the text "Location not found.ID: "

 

Test string:

Location not found. ID: ABC000123244343

Regex101 copied value:

/[ABC0]\w+[a-zA-Z0-9]/gm

 

However, when I tried the below in splunk it didn't provide me the results I expected:

 

| from datamodel:"xyzlogs"
| fields _raw
| where like(_raw,"%Location not found.ID: ABC000%")
| rex field=_raw "(?P<Location_id>/[ABC0]\w+[a-zA-Z0-9]/gm)"

 

 

Any help would be appreciated.

Thank you.

 

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Additionally, you can just include this "condition" in your regex.

But firstly make sure that your regex indeed does what you indend it to do.

Firstly you're looking for the string including "ABC000*", then you're matching against [ABC0] (that's a character class, not an explicit string).

What you need seems to be something more like

| rex field=_raw "Location\snot\sfound.ID:\s+(?<Location>ABC0\S+))

 Which matches only those strings that start with ABC0 and are preceeded with "Location not found" string. Otherwise the regex will simply not match so it will not extract anything.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You don't need everything from regex101, just the regex

| makeresults
| eval _raw="Location not found. ID: ABC000123244343"
| rex "(?P<Location_id>[ABC0]\w+[a-zA-Z0-9])"
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Additionally, you can just include this "condition" in your regex.

But firstly make sure that your regex indeed does what you indend it to do.

Firstly you're looking for the string including "ABC000*", then you're matching against [ABC0] (that's a character class, not an explicit string).

What you need seems to be something more like

| rex field=_raw "Location\snot\sfound.ID:\s+(?<Location>ABC0\S+))

 Which matches only those strings that start with ABC0 and are preceeded with "Location not found" string. Otherwise the regex will simply not match so it will not extract anything.

Steve_A200
Path Finder

Thank you for the prompt help, I found the best solution for my data logs was the suggestion below by @PickleRick :

| rex field=_raw "Location\snot\sfound.ID:\s+(?<Location>ABC0\S+))

It was what I needed to extract.

Thank you all for your help, appreciate this community and the Talent it has. 

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@Steve_A200 - As suggested by @ITWhisperer  , you just use the regex part of it.

/<regex>/<flags>

g & m are flags for global and multiline, which is true by default for Splunk's rex command.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...