Splunk Search

wether or is possible inside a regex

john
Communicator

hi,

A1.abc-ab.1000.11111
A1.ab.1000.11111

This is the format of data what iam trying to extract using regex.Since both the datas are values of same instance i want to exctract these both values using 1 regex so as to compare it with other values

... | rex field=_raw "(?<value>(\w\d\.\w+\-\w+\.\d{4}\-\d{8})|(\w\d\.\w+\.\d{4}\.d{7}))"| table value

this is what i have tried but it is fetching only the data matching with the first bracket ie A1.abc-ab.1000.11111 .Please help

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

There are a couple of errors in your regex, and you're probably making it too complicated. \w also matches digits, and you're missing the backslash for the last \d. Using character classes ([]) simplifies a lot.

rex field=_raw "\s(?<value>[\w]+\.[\w-]+\.\d+\.\d+)\s"

should do it. Note that this may also capture other stuff in your log. Please post some a couple of log events to get better answers.

Hope this helps,

Kristian

0 Karma

kristian_kolb
Ultra Champion

updated. /k

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...