Splunk Search

How can you do OR statements in rex?

jambajuice
Communicator

I'm trying to write a regex expression that extracts a field that ends in either a new line or a ":". I am trying to write the equivalent of (\n|:). When I use that kind of regex in a transforms.conf or props.conf file, it works fine. When I use it in a search command, it always treats the "|" OR symbol as a search pipeline. Is there any way to escape it using rex so that Splunk will treat it like an "OR"?

Thx.

Craig

Tags (1)
0 Karma

Paolo_Prigione
Builder

Lookbehinds are not particularly performant. Why not define your regex such as:

"\|(?<service_name>\w+\([^\)]+\))"

thus terminating the extraction at the closing parenthesis?

If else, you need a simple choice between one or more single characters, you can use a char class:

[\n:]

matches either a new line or a column.

jambajuice
Communicator

Putting the regex in quotes didn't help. I used the following lookbehind assertion to solve the problem:

(?<=))

0 Karma

jambajuice
Communicator

But for some reason when I display the results in a table, the values that do not end with |5 digits| appear as: unknown(5774/udp) 192.168.250. So, it looks like it is grabbing the next line up until the "|".

How do I tell rex to end the match on either a "|" or a new line character?

Thx.

0 Karma

jambajuice
Communicator

I have a field called "results" that looks like one of the following:

192.168.250|192.168.250.83|unknown (57753/udp)

OR

192.168.250|192.168.250.83|snmp (161/udp)|14274|

I'm trying to extract the service name and ports, such as "ssh (22/tcp)". Some extractions end with a new line, others with a |.

My rex is: rex field=results max_match=400 "(?i)\d+.\d+.\d+|\d+.\d+.\d+.\d+|(?P[^|]+)

0 Karma

Ayn
Legend

The reason Splunk treats the "|" symbol as a search pipeline is most likely because you're not putting your regex inside quotes. You're probably doing something like this:

yoursearch | rex field=_raw (?<yourfield>\n|:)

whereas you should be doing it like this:

yoursearch | rex field=_raw "(?<yourfield>\n|:)"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...