Splunk Search

Extract multiple fields with one RegEx

matthew_foos
Path Finder

Splunkers,

I'm trying to write one regex to extract a bunch of fields from a single event.

Here's an example of one event of some of the fields in one event:

avgtemp 50 hottemp 50 tempalert y tempflag y etc

I've tried using a pipe to separate the field extractions with no luck.

When I run the preview in the Splunk field extractor, I get no results. When I remove every capture group except the first one, it works just fine.

Any advice with the regex would be great.

Thanks

0 Karma

ryhluc01
Communicator

I think I would need some sample data but for the time being what comes before the regex can affect your results.

|regex Event_Sample="1st field|2nd field"

If you still could use an answer to this question just comment on this feed.

0 Karma

yannK
Splunk Employee
Splunk Employee

if your event is like

avgtemp 50 hottemp 50 tempalert y tempflag y etc

you can list each field : try

mysearch 
| rex "avgtemp (?<avgtemp>\d+) hottemp (?<hottemp>\d+) tempalert (?<tempalert)\w+) tempflag (?<tempflag>\d+)" " 
| table avgtemp hottemp tempalert tempflag

or you can use a field transforms and define the field name dynamically.
see transforms.conf

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms#Example_-_Extract...

example on disk on the search-head.
props.conf

[mysourcetype]
TRANSFORMS-myextraction=repeat_regex_space_separator

transforms.conf

 [repeat_regex_space_separator]
 REGEX = ([a-z])]\s(\d+)
 FORMAT = $1::$2
 REPEAT_MATCH = true
0 Karma

AnilPujar
Path Finder

What if this sequence is not in order:

avgtemp 50 hottemp 50 tempalert y tempflag y etc

avgtemp 50 tempalert y tempflag y etc hottemp 50

?

0 Karma

matthew_foos
Path Finder

I'm trying to do this in the field extractor.

SourceSystem\s(?P\w+)(.*?)TargetSystem\s(?P\w+)

Would the (.*?) work?

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Please provide a good set of example data (anonymized, but valid - only anonymize, don't change anything otherwise) that you also use the 101010 button on to make it be formatted correctly and it doesn't remove any characters) along with your non-working regular expression (again using the 101010 button for formatting). That will help tremendously in helping you.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...