Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: placing conditions in regex
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
placing conditions in regex
I have the following log format
13-11-22 00:03:06,124 [28c928c9] INFO: file abc.txt-ascii transferred
i want to transform the log into the following format
fri|november |11|2013|abc.txt|(a)
(a) which i mentioned above is the mode of the file either it will be in ascii or binary.if its binary (b) is displayed.
what will be the regex for this pattern in transforms.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Possible, but I'd take a different approach. Firstly, Ayn is also correct. You probably shouldn't do that. But if you really want to:
Transforms.conf
[rewrite_data_sample]
SEDCMD-rewrite = s/(\d+-\d+-\d+\s[^\s]+)\s*\[\w+\]\s*([^:]*):\s*\w+\s*([^-]*)-(\w)\w+\s\w+/\1|\3|\4|\2/g
[extract_data_sample]
REGEX = ([^\|]*)\|([^\|]*)\|([^\|]*)\|([^\|]*)
FORMAT = date_raw::$1 filename::$2 filemode::$3 log_level::$4
Props.conf
[YOUR_SOURCETYPE]
TRANSFORMS-rewrite = rewrite_data_sample
REPORT-newdata = extract_data_sample
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Make sure it is all on one line. Also, check my updated SED CMD.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is not working.No transformation is done on the logs
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is in my opinion beyond what you should be doing with basic regexes in Splunk. You should write a script that performs these transformations for you instead, as stuff like converting dates in the way you want are near to impossible to do with just regex. Things like determining the 13th is a Friday in a certain month without having strftime/strptime support would require some insane logic and conditions to get working in a regex.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No. Read the docs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To include and execute shell script in splunk,Should splunk be installed in UNIX
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
can you say me the procedure to include and execute scripts in splunk.Also i have installed splunk in windows os
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you Ayn.You said with scripts I can perform transformation.Can you say how to do that in splunk.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
