Splunk Search

Field transformation on source not working

archananaveen
Explorer

Hi There,

There is no content in dummy field although the regex works fine. Please could you help me with this?

Type: Regex-based
Regular expression: "(\/\w+){2}\/(?.?)\/"

Tried "(\/\w+){2}\/(?.
?)\/" in source

Source Key: source

Checked create multi valued fields.

same source field content is as below:
/folder1/folder2/SAMPLE1/Test.log
/folder1/folder2/SAMPLE2/Test.log

0 Karma

archananaveen
Explorer

This worked after | extract reload=true. However, output is displayed at times and doesn't show any at other times. Is there any way to extend the search time or what is the alternative way to fix this problem?
index = * sourcetype=xxxx| dedup pathName | sort pathName | table pathName

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There may be typos in your regular expressions. Please edit your question and put the regex strings inside backtics ('`') so all characters are preserved.

---
If this reply helps you, Karma would be appreciated.
0 Karma

archananaveen
Explorer

Regular expression inside the brackets: ('(\/\w+){2}\/(?.*?)\/')

In other blogs there is a mention of adding fields to *.conf's I do not have access for all those. Is there any workaround with UI Field transformers ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That regex has an error in it. The leading question mark in the "(?.*?)" bit is out of place. Perhaps it's supposed to be field extraction? If so, putting the entire regex inside back ticks will make it visible (or highlight it and click the "101010" button.

---
If this reply helps you, Karma would be appreciated.
0 Karma

archananaveen
Explorer
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried this alternative regex (\/\w+){2}\/(?<dummy>[^\/]*)\/?

---
If this reply helps you, Karma would be appreciated.
0 Karma

archananaveen
Explorer

this is not working, is there any different method to display the output of this transformation ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The /opt/splunk/bin/pcregextest command will show how Splunk is interpreting your regex string, which is likely to be different from web pages like regex101.com.

What is the context for this regex? Can you share the stanza in which it is used?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...