Splunk Search

Another Regex Question

kwkeefer
Explorer

I'm trying to rex out a new field from the message.Exception field. What I'm trying to extract is in the brackets below (the brackets are not actually in the Splunk message):

com.companyname.companyinitials.[servicename.servicenameApplication].main

I need to make it so that the regex looks for something that starts with "com.companyname.companyinitials." and ends with ".main" as the message.Exceptions field also contains something that starts with "com.companyname.companyinitials." but it is unrelated to the field I'm trying to extract.

I've tried to hack together some regex based on my google searching (I'm decent at regex for python but I can't figure out Splunk's for some reason) and I'm not doing very well. Here's what I have so far (which isn't working obviously):

...query... | rex field=message.Exception "com\.companyname\.companyinitials\.(?<Service>[^(main)]"

I'm getting a new field, but it only contains one character, and it seems to be the character for the other unrelated line that starts with the same "com.companyname.companyinitials." ...

I appreciate any help - sorry for being bad at regex..

0 Karma
1 Solution

gokadroid
Motivator

How about trying this to save the required text in field requiredText

...query... | rex field=message.Exception "com\.companyname\.companyinitials\.(?<requiredText>[\S]+)\.main"

See extraction here

View solution in original post

gokadroid
Motivator

How about trying this to save the required text in field requiredText

...query... | rex field=message.Exception "com\.companyname\.companyinitials\.(?<requiredText>[\S]+)\.main"

See extraction here

mayurr98
Super Champion

hey Try this run anywhere search

| makeresults 
| eval message.Exception="com.companyname.companyinitials.servicename.servicenameApplication.main" 
| rex field="message.Exception" "com\.companyname\.companyinitials\.(?<Service>.*)\.main"

In your environment, you should write

...query... | rex field=message.Exception "message.Exception" "com\.companyname\.companyinitials\.(?<Service>.*)\.main"

let me know if this helps!

0 Karma

493669
Super Champion

Try this:

|rex field="message.Exception"  "com\.companyname\.companyinitials\.(?<serviceName>\w+\.\w+)\.main"

gokadroid
Motivator

This regex has the flaw that if there are more than two elements in the requirement stated in question and I quote I need to make it so that the regex looks for something that starts with "com.companyname.companyinitials." and ends with ".main" as the message this will fail for sure.
It will fail for something like this with three elements between com.companyname.companyinitials and .main:

com.companyname.companyinitials.servicename.servicenameApplication.abc.main

0 Karma

adonio
Ultra Champion

hope i understood you correctly,
give this a try:

 ... search ... | rex field="message.Exception" "com\.companyname\.companyinitials.\[(?<serviceName>\w+)\.(?<serviceNameAplication>\w+)]\.main"

extracting two fields: serviceName and serviceNameApllication
if you want one field:

 ... search ... | rex field="message.Exception" "com\.companyname\.companyinitials.\[(?<serviceName>\w+\.\w+)]\.main"

hope it helps

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...