Splunk Dev

why does a ".*" extraction line ruin my query?

tfortne
Engager

Here is my original query:
tag=autoexpress_prod level=debug mdc.InvocationName=calculatePremiumAutoProcessc "serviceRequestName"
| rex field=message "<FirstName>(?\w+)"
| rex field=message "<LastName>(?\w+)"
| rex field=message "<MaritalStatus>(?\w+)"
| dedup Married Fname Lname mdc.QuoteID
| join mdc.QuoteID
[search tag=autoexpress_prod level=debug mdc.InvocationName=recordBillingAccount "webservice request XML"
| rex field=message "<bil:externalPolicyNum>(?.{0,12})"]
| rename mdc.State as State, mdc.QuoteID as QuoteID
| table _time, PolicyNumber, State, QuoteID, Fname, Lname, Married
| sort 0 Fname Lname
| streamstats count by Fname Lname QuoteID
| eventstats max(count) as keep by Fname Lname
| search keep=2

it looks for people that change their marital status. The problem arises when I add this line: | rex field=message"<DECFirstName>(?<Message>.*)</DECFirstName>"
it completely prevents the query from grabbing certain pieces of data and I have no idea why?

Tags (1)
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

I'm not sure if it is just the formatting or a typo, but after the field=message you don't have a space before the double quote. That causes an error in the rex command processing. I tried this, which worked:

| makeresults | eval message="<DECFirstName>This is it</DECFirstName>" | rex field=message "\<DECFirstName\>(?<Message>.*)\</DECFirstName\>"

So I think that your rex is almost fine, it the only thing is the spacing before the double quote.

DalJeanis
Legend

That's what it looks like to me.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi tfortne,
could you share your search using the Code sample button (101 010) because we cannot see your regexes.
Bye.
Giuseppe

0 Karma

tfortne
Engager
tag=autoexpress_prod level=debug mdc.InvocationName=calculatePremiumAutoProcessc "serviceRequestName" 
          | rex field=message "\&lt;DECFirstName\&gt;(?&lt;Message&gt;.*)\&lt;/DECFirstName\&gt;"
          | rex field=message "\&lt;FirstName\&gt;(?&lt;Fname&gt;\w+)" 
          | rex field=message "\&lt;LastName\&gt;(?&lt;Lname&gt;\w+)" 
          | rex field=message "\&lt;MaritalStatus\&gt;(?&lt;Married&gt;\w+)"
          | dedup Married Fname Lname mdc.QuoteID
          | join mdc.QuoteID 
[search tag=autoexpress_prod level=debug mdc.InvocationName=recordBillingAccount "webservice request XML" 
          | rex field=message "\&lt;bil:externalPolicyNum\&gt;(?&lt;PolicyNumber&gt;.{0,12})"]
          | rename mdc.State as State, mdc.QuoteID as QuoteID
          | table _time, PolicyNumber, State, Fname, Lname, Married, Message
          | sort 0 Fname Lname 
          | streamstats count by Fname Lname QuoteID
          | eventstats max(count) as keep by Fname Lname
          | search keep=2

Here, sorry about that. I tried the fix, and it seemed to work, But i think the issue appears when i add the sorting function to it. For some reason the DECFirstName field makes the code drop results.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...