Splunk Search

Option to extract one specific field from different patterns in one go ?

pari04home
New Member

For the same sourcetype, I have a lot many different patterns from which I want to extract one specific field. Is there an option to handle all these extractions (same sourcetype different patterns) in one go instead of going via multiple regex field extractions ?

0 Karma

niketn
Legend

@pari04home, as you would understand, if you have multiple patterns within your sourcetype you would need to provide us with mock/sample data for all possible patterns for us to assist you with your regular expression.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Without clarity in data constraints, like what does it mean by "different patterns" and "one specific field", it is hard to give any definitive answer. Are you looking for the same type of data embedded in different contexts, or are you looking for a potentially different data type when context is different? Regex is extremely versatile when matching patterns if you are willing to invest in it. It all depends on the actual data, is there an order of appearance for patterns, how regular the rest of the patterns are, and so on. In my experience, there are advantages and disadvantages for one-go vs multiple rex commands. If you know your data well, it is nearly always possible to construct a single rex command to extract every pattern if you work hard enough. But if you want to capture just those combinations that you haven't thought of, multiple runs are easier.

One whacky example is this pair of constructs:

William is my nephew
My auntie is Betty
How to extract the relationship in one go? You can use ^((?<name>.+) (is|are) (my|our|your|his|her|their) (?<relation>.+)|(My|Our|Your|His|Her|Their) (?<relation>.+) (is|are) (my|our|your|his|her|their) (?<name>.+)). Is this doable? Perhaps yes. Is this practical? Probably not.

Machine data are probably better than natural language. But if you are parsing application logs, more often than not, different pieces of a pattern may appear in some context and not in others. Nowadays I just use multiple passes unless I have confidence that the data space is limited.

0 Karma

MonkeyK
Builder

regex supports an "OR" operator by using a pipe character "|" between matching expressions.

For example (comes with Splunk)
(?:objectguid|guid)\s*=\s*(?[\w-]+)

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...