Splunk Search

Option to extract one specific field from different patterns in one go ?

pari04home
New Member

For the same sourcetype, I have a lot many different patterns from which I want to extract one specific field. Is there an option to handle all these extractions (same sourcetype different patterns) in one go instead of going via multiple regex field extractions ?

0 Karma

niketn
Legend

@pari04home, as you would understand, if you have multiple patterns within your sourcetype you would need to provide us with mock/sample data for all possible patterns for us to assist you with your regular expression.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Without clarity in data constraints, like what does it mean by "different patterns" and "one specific field", it is hard to give any definitive answer. Are you looking for the same type of data embedded in different contexts, or are you looking for a potentially different data type when context is different? Regex is extremely versatile when matching patterns if you are willing to invest in it. It all depends on the actual data, is there an order of appearance for patterns, how regular the rest of the patterns are, and so on. In my experience, there are advantages and disadvantages for one-go vs multiple rex commands. If you know your data well, it is nearly always possible to construct a single rex command to extract every pattern if you work hard enough. But if you want to capture just those combinations that you haven't thought of, multiple runs are easier.

One whacky example is this pair of constructs:

William is my nephew
My auntie is Betty
How to extract the relationship in one go? You can use ^((?<name>.+) (is|are) (my|our|your|his|her|their) (?<relation>.+)|(My|Our|Your|His|Her|Their) (?<relation>.+) (is|are) (my|our|your|his|her|their) (?<name>.+)). Is this doable? Perhaps yes. Is this practical? Probably not.

Machine data are probably better than natural language. But if you are parsing application logs, more often than not, different pieces of a pattern may appear in some context and not in others. Nowadays I just use multiple passes unless I have confidence that the data space is limited.

0 Karma

MonkeyK
Builder

regex supports an "OR" operator by using a pipe character "|" between matching expressions.

For example (comes with Splunk)
(?:objectguid|guid)\s*=\s*(?[\w-]+)

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...