Splunk Dev

why does a ".*" extraction line ruin my query?

tfortne
Engager

Here is my original query:
tag=autoexpress_prod level=debug mdc.InvocationName=calculatePremiumAutoProcessc "serviceRequestName"
| rex field=message "<FirstName>(?\w+)"
| rex field=message "<LastName>(?\w+)"
| rex field=message "<MaritalStatus>(?\w+)"
| dedup Married Fname Lname mdc.QuoteID
| join mdc.QuoteID
[search tag=autoexpress_prod level=debug mdc.InvocationName=recordBillingAccount "webservice request XML"
| rex field=message "<bil:externalPolicyNum>(?.{0,12})"]
| rename mdc.State as State, mdc.QuoteID as QuoteID
| table _time, PolicyNumber, State, QuoteID, Fname, Lname, Married
| sort 0 Fname Lname
| streamstats count by Fname Lname QuoteID
| eventstats max(count) as keep by Fname Lname
| search keep=2

it looks for people that change their marital status. The problem arises when I add this line: | rex field=message"<DECFirstName>(?<Message>.*)</DECFirstName>"
it completely prevents the query from grabbing certain pieces of data and I have no idea why?

Tags (1)
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

I'm not sure if it is just the formatting or a typo, but after the field=message you don't have a space before the double quote. That causes an error in the rex command processing. I tried this, which worked:

| makeresults | eval message="<DECFirstName>This is it</DECFirstName>" | rex field=message "\<DECFirstName\>(?<Message>.*)\</DECFirstName\>"

So I think that your rex is almost fine, it the only thing is the spacing before the double quote.

DalJeanis
Legend

That's what it looks like to me.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi tfortne,
could you share your search using the Code sample button (101 010) because we cannot see your regexes.
Bye.
Giuseppe

0 Karma

tfortne
Engager
tag=autoexpress_prod level=debug mdc.InvocationName=calculatePremiumAutoProcessc "serviceRequestName" 
          | rex field=message "\&lt;DECFirstName\&gt;(?&lt;Message&gt;.*)\&lt;/DECFirstName\&gt;"
          | rex field=message "\&lt;FirstName\&gt;(?&lt;Fname&gt;\w+)" 
          | rex field=message "\&lt;LastName\&gt;(?&lt;Lname&gt;\w+)" 
          | rex field=message "\&lt;MaritalStatus\&gt;(?&lt;Married&gt;\w+)"
          | dedup Married Fname Lname mdc.QuoteID
          | join mdc.QuoteID 
[search tag=autoexpress_prod level=debug mdc.InvocationName=recordBillingAccount "webservice request XML" 
          | rex field=message "\&lt;bil:externalPolicyNum\&gt;(?&lt;PolicyNumber&gt;.{0,12})"]
          | rename mdc.State as State, mdc.QuoteID as QuoteID
          | table _time, PolicyNumber, State, Fname, Lname, Married, Message
          | sort 0 Fname Lname 
          | streamstats count by Fname Lname QuoteID
          | eventstats max(count) as keep by Fname Lname
          | search keep=2

Here, sorry about that. I tried the fix, and it seemed to work, But i think the issue appears when i add the sorting function to it. For some reason the DECFirstName field makes the code drop results.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...