Splunk Search

regex help

SS1
Path Finder

Hi,

I need some help with the regex,

Currently we have below two paths, note the naming format is different for the log files

\\path\\to\\my\\app\\folder\userx-test-cpuissue.log
\\path\\to\\my\\app\\folder\usery-cpuissue.log

 

I wrote a regex to extract user and issue, but it is not able to pick userx since the log format is different i.e. userx-test-cpuissue.log. How do i wrote a single regex which could extract both the naming formats?

\\\\(?<source>\w+)-(?<issue>\w+)\.log$

Labels (5)
0 Karma

abowesman
Explorer

You could try this

| rex field=log "\\\\(?<user>\w+)-(?<issue>.*)\.log$"

where your 'issue' field extraction takes _any_ character up to the .log after the user rather than \w.

Shown in this example

| makeresults
| eval log=split("\\\\path\\\\to\\\\my\\\\app\\\\folder\\userx-test-cpuissue.log,\\\\path\\\\to\\\\my\\\\app\\\\folder\\usery-cpuissue.log",",")
| mvexpand log
| rex field=log "\\\\(?<user>\w+)-(?<issue>.*)\.log$"

Hope this helps

 

0 Karma

SS1
Path Finder

thanks for the response, although it is extracting just userx while i want it to extract userx-test. is that possible?

0 Karma

ITWhisperer
Legend
\\(?<source>[\w\-]+)\-(?<issue>\w+)\.log$

ITWhisperer
Legend
\\(?<source>\w+)(\-\w+)?\-(?<issue>\w+)\.log$
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!