Splunk Search

Why am I getting different results for this field extraction?

daniel333
Builder

All,

When I search and use rex I get the ports from the Apache logs as expected. Getting all ports 80 and 443 and 8080.
index=web 443 | rex field=_raw "^\d+.\d+.\d+.\d+ - (?\d+) ["

How ever, when I place the same extraction in props.conf it only gets port 80
[apache:access]
EXTRACT-port = ^\d+.\d+.\d+.\d+ - (?\d+) [

Any idea where my mistake is?

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Try:

EXTRACT-port = ^\d+\.\d+\.\d+\.\d+ - (?P<port>\d+) \[
0 Karma

skoelpin
SplunkTrust
SplunkTrust

The field is relative to the sourcetype you specify. Try explicitly including the sourcetype you defined in your props.conf in your search and see if you get the same results

0 Karma

DalJeanis
Legend

Your regexes look wrong to me.

Remember a period matches ANYTHING. If you mean only a . character, then you need to escape it.

so, for instance, matching this regex up with the IP that follows it...

 ^\d+.\d+.\d+.\d

 123.123.33.12

...means that the first \d+ matches the 1, the . matches the 2, the second \d+ matches the 3, the second . matches the first ., and so on.

Escape all those periods and try your test again.

0 Karma

niketn
Legend

@daniel333, Can you post your code with code button 101010 on Splunk Answers so that special characters do not escape?

Also can you add few mocked up sample events with different port numbers?

Ideally if rex is working in search, then same regular expression should also fetch when saved as Field Extraction (?<port>\d+).

Can you try Interactive Field Extraction in Splunk with your regular expression and see if you have Non Matches, or maybe let Splunk generate the regular expression, by adding non-matches.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...