Splunk Search

How to edit my regex to extract this pattern from my sample data?

koushiknandan
New Member

I am trying to extract a pattern as below. Tried a few things, but all sorts of junk data is being picked up.

Event (Data)
2000-04-01T12:11:14,660 INFO [[abcdef4-abcdefghij].abcdEfghijklm.nopqrstu.21] [AbcDefghi] ABCD EFGH : ILIKEYO_KNOW | ABCDE FGHI : WAR_RIGG_IS_BAD | ABCDEF GH : XYZ1190560709120516-88328[ABCDEFG HIJKLM : 5.7_WOLFER]

Tried with the following

* | rex field=_raw "^(?:[^:\n]*:){5}\s+(?P[^\[]+)"
  1. I am trying to extract the entire text (in bold). The above pattern gives me the text, but other fields are also getting matched. How can I strengthen the regex so that only this type of event gets analyzed?

  2. Is it possible to use some of the text fields which would be unique (colored in blue), so that they can be used in a better way?

Thanks in Advance,
Koushik

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

One way of doing it could be using the following regex:

| rex field=_raw "(?msi)\|[\w\s]+:\s+(?<pattern>[\w\s\-]+)\[[^\]]+\]$"

That will create a new field called pattern with the text in bold you were referring too.
If you wanted to include some of the text fields in blue that you reckon will be static you could, but the regex above is already extremely fast (just 22 steps to match what you are looking for).

Keep in mind your text in bold has to be an alphanumeric character, space or hyphen in order to match this: [\w\s-]+
If that's not the case you will need to include any new possible character that might appear between the square brackets.

View solution in original post

0 Karma

javiergn
SplunkTrust
SplunkTrust

One way of doing it could be using the following regex:

| rex field=_raw "(?msi)\|[\w\s]+:\s+(?<pattern>[\w\s\-]+)\[[^\]]+\]$"

That will create a new field called pattern with the text in bold you were referring too.
If you wanted to include some of the text fields in blue that you reckon will be static you could, but the regex above is already extremely fast (just 22 steps to match what you are looking for).

Keep in mind your text in bold has to be an alphanumeric character, space or hyphen in order to match this: [\w\s-]+
If that's not the case you will need to include any new possible character that might appear between the square brackets.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...