Splunk Search

Adding a fieldname to a regex extraction

agodoy
Communicator

I have this regex (https?:\/\/)?(www)?(.)?([a-z\d-]{2,})?(.)?([a-z\d-]{2,})?(.)?([a-z\d-]{2,})?.[a-z]{2,4} that I want to use to extract a new field.

How do I incorporate a field name to that regex to use in field extraction.
Thanks!

Tags (3)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

you need to define a special group with (?< fieldname >regexmatch)

read the documentation for examples :
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Rex

View solution in original post

Rob
Splunk Employee
Splunk Employee

Quite possibly, I would say that you may want to try doing some atomic grouping. In other words, for all the grouped up stuff in parentheses, like this:

(https?)...

Change it to;

(?:https?)

0 Karma

agodoy
Communicator

Thank you both.

So I changed my search to:

(?<name>(https?:\/\/)?(www)?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?\.[a-z]{2,4})

It works when I do a ... | rex "(?<name>(https?:\/\/)?(www)?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?\.[a-z]{2,4})" | top 50 name.

However, if I try to save a field extraction with that same regex I get an error"Encountered the following error while trying to update: In handler 'props-extract': Regex: syntax error in subpattern name (missing terminator)". It might be because of my dirty regex.

Thanks

0 Karma

Rob
Splunk Employee
Splunk Employee

Hi agodoy,

To extract fields using the Splunk search language, you will want to use the rex command. This is in the syntax of:

|rex field=myFieldName "myRegex(?regexToMatchValueForMyNewField)anyOtherRegex"

More info can be found in the docs.

Looking at your regex, you may want to clean up the regex a little.

0 Karma

Rob
Splunk Employee
Splunk Employee

Thank you sir! Nice job to you as well!

0 Karma

yannK
Splunk Employee
Splunk Employee

nice job mister

0 Karma

yannK
Splunk Employee
Splunk Employee

you need to define a special group with (?< fieldname >regexmatch)

read the documentation for examples :
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Rex

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...