Splunk Search

Regular Expression if then else

jessicadrechsel
New Member

Hello everyone.

I have field which sometimes contains Profilename and Stepname and sometimes just the Profilename.
I would like to extract the profilename and stepname.

Example: Test_Profile-TestStep
Test_Profile is the profilename
TestStep is the stepname
It`s always combined with an -

So if there is no - then the whole field is the profilename.

I´m absolutely not confirm with regular expressions.

I`ve tried this

(?(?=\b-\b)(?P<ProfileStep>[^-"]+)|(?P<ProfileStep>[^"]+))

But splunk says "Regex: two named subpatterns have the same name"

I would be so happy about some help. 😄

Kind regards
Jessi

0 Karma

adonio
Ultra Champion

@jessicadrechsel,
looking at your data, it seems like you have key value pairs there for Profilename and Stepname. best will be to extract permanently with field extractor, also i would suggest to check your data in verbose mode as splunk is pretty good at understanding field=value structure.
in any case try the following:

 ... your search ... | rex "Profilename=(?<Profilename>\S+)" 
                               | rex "Stepname=(?<Stepname>\S+)"

hope it helps

0 Karma

jessicadrechsel
New Member

Got the problem solved for the profile name

(?J)(?(?=\b-\b)(?P<ProfileStep>[^"]+)|(?P<ProfileStep>[^-"]+))

Now I try to figure it out for the stepname

(?J)(?(?=\b-\b)(?+[^-"]P<Stepname>)|(?+[^"]P<Stepname>))      <== not working
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Can you please try below regex

(?<Profilename>\w+)[\-]?(?<Profilestep>.*)

If you want to test this regex then please check https://regex101.com/r/3XdfSv/2

0 Karma

jessicadrechsel
New Member

Thats not working. 😞

For example a whole line - with stepname - looks like that:
2018-04-13 08:13:51,"germany","e2e_appmon","GEV_Muenchen_DE_MU_X2SLM39","DE_MU_X2SLM39","GEV_ADPortal-Zusatzdaten_erfassen",2018-04-13 08:13:50,763,"QOS_E2E_EXECUTION"
Profilename=GEV_ADPortal
Stepname=Zusatzdaten_erfassen

A line without stepname looks like that:
2018-04-13 08:13:51,"germany","e2e_appmon","GEV_Muenchen_DE_MU_X2SLM39","DE_MU_X2SLM39","GEV_ADPortal",2018-04-13 08:13:50,763,"QOS_E2E_EXECUTION"
Profilename=GEV_ADPortal
Stepname= or if this is not possible then I can write the profilename in stepname

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...