Splunk Search

What regular expression can be used to extract literals between slashes?

raghunand
Explorer

Ex:

/nfs/tibcosoftware/splunk/impactAnalysis/freight/ConwayServicesOMSEvents/1.01-49/AESchemas
/nfs/tibcosoftware/splunk/impactAnalysis/freight/Conway-OMSEvents/1.01-SNAPSHOT-57/AESchemas

iaComponent=freight
iaProjectName= ConwayServicesOMSEvents or Conway-OMSEvents                       
iaReleasedVersionName= 1.01-49 or 1.01-SNAPSHOT-57

I have tried the following, but I cannot get <Project> literals with - or <Version> literals with no SNAPSHOTS.

index=eicoe_tibco_ia sourcetype=eicoe_tibco_ia "wsdl"  | rex field=iaSource "(/\w*)+(/\w*)+(/\w*)+(/\w*)+(?<iaComponent>(/\w*))+(?<iaProjectName>(/\w*))+(?<iaReleasedVersionName>(/\d*)\.(\d*)[^-]*(-SNAPSHOT))" | dedup iaComponent, iaProjectName, iaReleasedVersionName | table iaComponent, iaProjectName, iaReleasedVersionName

Please advise?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this regex

\/(?:[^\/]*\/){4}(?P<iaComponent>[^\/]+)\/(?P<iaProjectName>[^\/]+)\/(?P<iaReleasedVersionName>[^\/]+)\/
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this regex

\/(?:[^\/]*\/){4}(?P<iaComponent>[^\/]+)\/(?P<iaProjectName>[^\/]+)\/(?P<iaReleasedVersionName>[^\/]+)\/
---
If this reply helps you, Karma would be appreciated.

raghunand
Explorer

Thank you Rich - I did get most of the desired results all versions except for versions with SNAPSHOT. Any idea how to include the SNAPSHOTS?
I am adding a few example paths here:
/nfs/tibcosoftware/Splunk/impactAnalysis/menlo/FSIValidationForClassic/1.02-SNAPSHOT-1.02-SNAPSHOT.24
/nfs/tibcosoftware/Splunk/impactAnalysis/sharedapps/CSCHRCompanyEventPublisher/1.0.0-8
/nfs/tibcosoftware/Splunk/impactAnalysis/freight/ConwayServices-Customer/1.04-SNAPSHOT-47

index=eicoe_tibco_ia sourcetype=eicoe_tibco_ia "wsdl"  | rex field=iaSource "\/(?:[^\/]*\/){4}(?P[^\/]+)\/(?P[^\/]+)\/(?P[\d\.\-]+)(?:\/|-SNAPSHOT)" | dedup iaComponent, iaProjectName, iaReleasedVersionName | table iaComponent, iaProjectName, iaReleasedVersionName
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sorry, I thought you intended to exclude snapshots. I've updated my answer to include them.

---
If this reply helps you, Karma would be appreciated.
0 Karma

raghunand
Explorer

Sure my bad ! I see this seems to return what I want

index=eicoe_tibco_ia sourcetype=eicoe_tibco_ia "wsdl" | rex field=iaSource "\/(?:[^\/]*\/){4}(?P[^\/]+)\/(?P[^\/]+)\/(?P[^\/]+)\/" | dedup iaComponent, iaProjectName, iaReleasedVersionName | table iaComponent, iaProjectName, iaReleasedVersionName

Thank you !!

0 Karma

sundareshr
Legend

Not sure if your Projectname has both always or you have it here just as an example of possible names. If it is just an example, you can exclude the rex for pname1

ProjectName=\s(?<pname>[\w-]+)\sor\s(?<pname1>[\w-]+)

Not sure I understand you comment about no SNAPSHOTS. But here's something for you to work with

VersionName=\s(?<pname>[\d\.-]+)\sor\s(?<pname1>[\d\.]+)
0 Karma

raghunand
Explorer

Thank you sundar. But I could not get any results.. maybe the search command is wrong... Here is what I tried

index=eicoe_tibco_ia sourcetype=eicoe_tibco_ia "wsdl" | rex field=iaSource "\s(?[\d.-]+)\sor\s(?[\d.]+)" | dedup pname, pname1 | table pname, pname1

0 Karma

sundareshr
Legend

Now I see what you are looking for. Try this

\/(?:[^\/\s]*\/){4}(?<iaComponent>[^\/]+)\/(?<iaProjectName>[^\/]+)\/(?<iaReleasedVersionName>[^\/]+)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...