Splunk Search

Informix Audit Regular Expression

klkumar10
Explorer

I have the following content in the log file

====

ONLN|2010-07-06 13:53:52.000|test.tester.com|1068|db_server_name|informixuser|0:RDRW:dbname:477:139460610:483356

ONLN|2010-07-06 14:39:58.000|testpc.tester.com|8368|db_server_name|mware|0:OPDB:dbname:0:-

ONLN|2010-07-06 13:54:00.000|testpc2.test.com|9122|db_server_name|informix|0:ACTB:sysmaster:informix:sysadtinfo:166
.
.

====

When I use the following Regular Expression in the search string it works and gives the exact result I am looking for:

====

rex ".*?(\|).*?(\|).*?(\|).*?(\|).*?(\|)(?P<FIELDNAME>\w+)(\|)" | fields FIELDNAME

====

But When I try to use Extract Fields and there If I try to give this as my Regular Expression, it is giving me error:

====

Invalid regex: no named extraction at position 3 (i.e., "(\|).*?(\|..."). Expected "(?P<variable>;pattern)"

====

Can someone please help me in identifying the error?

My Aim is to make the 6th Field (| delimited) as a new field userid

Tags (1)
0 Karma
1 Solution

Michael_Wilde
Splunk Employee
Splunk Employee

First of all.. You need your field to be named in a capturing group. When you're using "rex", Splunk needs to know what you'd like your field name called. I'm not sure why you're capturing all those "pipe" characters in parens... I'd have written the regex like this. Its cleaner and more exact.

(syntax is "anything thats not a pipe--many times", followed by a pipe.. (repeated until you get to your sixth field).

|rex "[^\|]+\|[^\|]+\|[^\|]+\|[^\|]+\|[^\|]+\|(?<FIELDNAME>[^\|]+)"

View solution in original post

Michael_Wilde
Splunk Employee
Splunk Employee

First of all.. You need your field to be named in a capturing group. When you're using "rex", Splunk needs to know what you'd like your field name called. I'm not sure why you're capturing all those "pipe" characters in parens... I'd have written the regex like this. Its cleaner and more exact.

(syntax is "anything thats not a pipe--many times", followed by a pipe.. (repeated until you get to your sixth field).

|rex "[^\|]+\|[^\|]+\|[^\|]+\|[^\|]+\|[^\|]+\|(?<FIELDNAME>[^\|]+)"

klkumar10
Explorer

I used the above expression directly in the props.conf file and able to use it. I did not use the IFX.

0 Karma

klkumar10
Explorer

Actually I am new to using Regular Expressions.
Your RE solved my problem.

Thanks a lot.

0 Karma

ftk
Motivator

Modify your regex as follows in the IFX (Interactive Field eXtraction) and it should work:

.?(\|).?(\|).?(\|).?(\|).*?(\|)(?P<FIELDNAME>\w+)(\|)
0 Karma

klkumar10
Explorer

I tried above in the IFX, and it is giving me error:

Invalid regex: no named extraction at position 2 (i.e., "(|).?(|)..."). Expected "(?P<variable>pattern)"

Anyway thanks for the response. Now my issue is resolved as per the previous answer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...