Regex to print 7th word of a one if a particular condition is met

[saranyaa21]

Hi ,

below is the sample data :

12:10:32,946 INFO [class_name] [IP address] [id1] [-] [null,null,null,null,null,null,pincode] Logged in.
12:10:32,968 INFO [class_name] [IP address] [id1] [-] [name,id,location,street,state,country,pincode] Performing activity.

I'm trying to print the class name if 6th word is [-] and 7th word contains null values in it.

I'm using the following regex to do so:
rex field=_raw "(^(?:\S+\s+){2})(?<"Class_name">(\S+))" |rex field=_raw "(?<"Details">(?<=[-]\s[null).*pincode])"'

My challenge here:
This regex only captures the class_name and null,null,null,null,null,null,pincode . Actually, the same class has already printed the details for the same id id1 in a different place.

How should I correct my regular expression, in order to check, if the class has already printed the details, and to skip that class from the collection of empty details printing class list .

Thanks in advance .

[kamlesh_vaghela · Accepted solution]

Can you please try this?

YOUR_SEARCH | rex field=_raw "(^(?:\S+\s+){2})\[(?<Class_name>(\S+))\]"  |rex field=_raw "(?<Details>(\[-\]\s\[null.*pincode]))" | dedup Class_name

My Sample Search:

| makeresults | eval d="12:10:32,946 INFO [class_name] [IP address] [id1] [-] [null,null,null,null,null,null,pincode] Logged in.||12:10:32,968 INFO [class_name] [IP address] [id1] [-] [name,id,location,street,state,country,pincode] Performing activity." | eval d=split(d,"||") | mvexpand d | eval _raw=d | fields _raw | rex field=_raw "(^(?:\S+\s+){2})\[(?<Class_name>(\S+))\]"  |rex field=_raw "(?<Details>(\[-\]\s\[null.*pincode]))" | dedup Class_name

[saranyaa21]

Hello @kamlesh_vaghela ,

Your sample search works, as expected. But how do I use my search, to combine different pieces of logs as you have done in

| makeresults | eval d="12:10:32,946 INFO [class_name] [IP address] [id1] [-] [null,null,null,null,null,null,pincode] Logged in.||12:10:32,968 INFO [class_name] [IP address] [id1] [-] [name,id,location,street,state,country,pincode] Performing activity." | eval d=split(d,"||") | mvexpand d | eval _raw=d | fields _raw | rex field=_raw "(^(?:\S+\s+){2})[(?(\S+))]" |rex field=_raw "(?([-]\s[null.*pincode]))" | dedup Class_name

[saranyaa21]

In this query below since two line, it was explicitly mentioned for comparison. But how do I compare huge logs when I don't know what will be the log entry.

| makeresults | eval d="12:10:32,946 INFO [class_name] [IP address] [id1] [-] [null,null,null,null,null,null,pincode] Logged in.||12:10:32,968 INFO [class_name] [IP address] [id1] [-] [name,id,location,street,state,country,pincode] Performing activity." | eval d=split(d,"||") | mvexpand d | eval _raw=d | fields _raw | rex field=_raw "(^(?:\S+\s+){2})[(?(\S+))]" |rex field=_raw "(?([-]\s[null.*pincode]))" | dedup Class_name

should I try something like,

| makeresults | eval d="sourcetype=serverlog||sourcetype=serverlog | eval d=split(d,"||") | mvexpand d | eval _raw=d | fields _raw | rex field=_raw "(^(?:\S+\s+){2})[(?(\S+))]" |rex field=_raw "(?([-]\s[null.*pincode]))" | dedup Class_name

How should I pass the raw field here , the entire logs here ?!

[kamlesh_vaghela]

@saranyaa21

You have to use below portion of search with your event, Like if your events are in abc index and xyz sourcetype the your search should be like below

index=abc sourcetype=xyz  | rex field=_raw "(^(?:\S+\s+){2})[(?(\S+))]" |rex field=_raw "(?([-]\s[null.*pincode]))" | dedup Class_name

[saranyaa21]

Dedup worked. Thanks @kamlesh_vaghela

[kamlesh_vaghela]

Gald to help you @saranyaa21. Can you please accept this answer to close this question?

[saranyaa21]

done Kamlesh