Splunk Search

How to write regex to extract a string, but ignore the last portion if a certain string is present?

Smith_Splunk
Explorer

Hi All,

Below are the two different events we have,

1) DateTime="2014-11-04 06:42:35" SourceFile=ABCD.EFGH.IJKL.ABCTFILE DestFile=XYZA.R160001B.WERT10.A0005.H0001B00
2) DateTime="2014-11-04 06:41:35" SourceFile=XYZA.ER5678A.WERT10.T0005.J0001B00 DestFile=XYZA.R160001B.WERT10.A0005.H0001B00

We need to extract the string which is highlighted in BOLD from SourceFile. The rule is to ignore the complete word where "BOO" is present in end of the string(In 2nd event "J0001B00") or extract complete string if "BOO" is not present (in 1st Event)

We wrote a regEx which will match ---> (?i)SourceFile\W(.?).\w+\s
**ABCD.EFGH.IJKL
* from 1st event ==> here "ABCTFILE" is missing
XYZA.ER5678A.WERT10.T0005 from 2nd event

We have issues in extracting from 1st event.

Online RegEx Editor with above Events
http://rubular.com/r/O6tB73XSpz
Can any one please help to write proper regEx which will extract both string

Thanks,
Smith

1 Solution

gfuente
Motivator

Hello

Try with this regex:

SourceFile\=(?<yourfield>(\w+|\.){7})(\sDestFile|\.\w*B00\s)

Regards

View solution in original post

gfuente
Motivator

Hello

Try with this regex:

SourceFile\=(?<yourfield>(\w+|\.){7})(\sDestFile|\.\w*B00\s)

Regards

davebrooking
Contributor

If the format of the filename is not a fixed number of period separated names, you could use something like

SourceFile\=(?P<yourfield>(\w+|\.)+?)(|\.\w*B00)\sDestFile\=
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...