Splunk Search

Regular Expression if then else

jessicadrechsel
New Member

Hello everyone.

I have field which sometimes contains Profilename and Stepname and sometimes just the Profilename.
I would like to extract the profilename and stepname.

Example: Test_Profile-TestStep
Test_Profile is the profilename
TestStep is the stepname
It`s always combined with an -

So if there is no - then the whole field is the profilename.

I´m absolutely not confirm with regular expressions.

I`ve tried this

(?(?=\b-\b)(?P<ProfileStep>[^-"]+)|(?P<ProfileStep>[^"]+))

But splunk says "Regex: two named subpatterns have the same name"

I would be so happy about some help. 😄

Kind regards
Jessi

0 Karma

adonio
SplunkTrust
SplunkTrust

@jessicadrechsel,
looking at your data, it seems like you have key value pairs there for Profilename and Stepname. best will be to extract permanently with field extractor, also i would suggest to check your data in verbose mode as splunk is pretty good at understanding field=value structure.
in any case try the following:

 ... your search ... | rex "Profilename=(?<Profilename>\S+)" 
                               | rex "Stepname=(?<Stepname>\S+)"

hope it helps

0 Karma

jessicadrechsel
New Member

Got the problem solved for the profile name

(?J)(?(?=\b-\b)(?P<ProfileStep>[^"]+)|(?P<ProfileStep>[^-"]+))

Now I try to figure it out for the stepname

(?J)(?(?=\b-\b)(?+[^-"]P<Stepname>)|(?+[^"]P<Stepname>))      <== not working
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Can you please try below regex

(?<Profilename>\w+)[\-]?(?<Profilestep>.*)

If you want to test this regex then please check https://regex101.com/r/3XdfSv/2

0 Karma

jessicadrechsel
New Member

Thats not working. 😞

For example a whole line - with stepname - looks like that:
2018-04-13 08:13:51,"germany","e2e_appmon","GEV_Muenchen_DE_MU_X2SLM39","DE_MU_X2SLM39","GEV_ADPortal-Zusatzdaten_erfassen",2018-04-13 08:13:50,763,"QOS_E2E_EXECUTION"
Profilename=GEV_ADPortal
Stepname=Zusatzdaten_erfassen

A line without stepname looks like that:
2018-04-13 08:13:51,"germany","e2e_appmon","GEV_Muenchen_DE_MU_X2SLM39","DE_MU_X2SLM39","GEV_ADPortal",2018-04-13 08:13:50,763,"QOS_E2E_EXECUTION"
Profilename=GEV_ADPortal
Stepname= or if this is not possible then I can write the profilename in stepname

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.