Splunk Search

How to write regex for filtering values with .,: in same field

umsundar2015
Path Finder

Hi,

I have below values in same field , i have to take the values(characters) before : .If the first value is ip address then full ip have to taken.
for example ,

10.102.208.108:sqlexpress( need full ip address from here)
ALATDEV1:OMGEO(Need ALATDEV1 from here)
SWSYBQ21.dtcc.com:1025 (Need SWSYBQ21 from here )
SWTEPQ0004.corp.dtcc.com:172.21.168.62:172.21.168.62:0:ServiceList.WebInspect Data Server (Need SWTEPQ0004)

Please suggest me .

Tags (2)
0 Karma

gokadroid
Motivator

This should work for all the cases if say the values are in field called testField:

your query to return testField
| rex field=testField "^(?<myField>(([\d\.]+)|(\w+)))[:.]"
| table myField

See extraction here.
You can also replace the last capturing group [:.] to include comma if required [:.,]

0 Karma

umsundar2015
Path Finder

hi gokandroid,

Thank you and this works perfectly ..

0 Karma

niketn
Legend

alt textHi @umsundar2015,
Will it be possible for you to give complete event as example i.e. whether there is a pattern before and pattern after the field you are trying to extract?

If not can you try Interactive Field Extraction to let Splunk generate regular expression for the required field extraction. In your test machine you can add some sample logs and use Extract New Fields option.

Refer to attached screenshot for a sample regular expression based IFX.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi umsundar2015,
Try something like this

^(?<field>[^:]*)

Bye.
Giuseppe

0 Karma

umsundar2015
Path Finder

Hi,

Thank you for your rex.

But still for this CVSQLP0001.corp.reds.com:MSSQLSERVER , i am getting CVSQLP0001.corp.reds.com

My requirement is to get CVSQLP0001 for the above scenario too.

Pls advice me .

0 Karma

gcusello
SplunkTrust
SplunkTrust

try this

^(?<field>[^:.]*)

Bye.
Giuseppe

0 Karma

umsundar2015
Path Finder

now the ip address is not proper , iam getting 10 alone for 10.102.208.108:SQLEXPRESS,
Pls suggest

0 Karma

gcusello
SplunkTrust
SplunkTrust

try this

^(?<field>((\d+\.\d+\.\d+\.\d+)|(\w+))*)

Bye.
Giuseppe

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...