- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Help with regex
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Help with regex
I have a log format that uses space as delim and "" as delim when we have space in between. How should i write the rex to split these fields out?
02-27-2014/04:30:21-0700 11.23.13.41 64.13.30.50 96.42.90.80 HTTP/1.1 GET abc.defghi.com /cs/aabd/ajax/ajax.wp 200 25575 642 35633 "?lcid=2401&mobile=false" "-" "TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0" "-"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would use this, but not in a search string with rex. You should use EXTRACT in props.conf with other parameters for the sourcetype.
[yoursourcetype]
EXTRACT-multifieldx = ^(?<datetimetz>\d+-\d+-\d+/\d+:\d+:\d+-\d+)\s(?<IP1>\d+\.\d+\.\d+\.\d+)\s(?<IP2>\d+\.\d+\.\d+\.\d+)\s(?<IP3>\d+\.\d+\.\d+\.\d+)\s(?<protocol>.*)\s(?<method>\w+)\s(?<site>.*)\s(?<path>.*)\s(?<metric1>\d+)\s\s(?<metric2>\d+)\s(?<metric3>\d+)\s(?<metric4>\d+)\s"(?<string1>[^"]+)"\s"(?<string2>[^"]+)"\s"(?<string3>[^"]+)"\s"(?<string4>[^"]+)"\s
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Correct. So my delims would be both space and " ". And the number of fields is always same.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are these the fields you're trying to extract?
02-27-2014/04:30:21-0700
11.23.13.41
64.13.30.50
96.42.90.80
HTTP/1.1
GET
abc.defghi.com
/cs/aabd/ajax/ajax.wp
200
25575
642
35633
"?lcid=2401&mobile=false"
"-"
"TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0"
"-"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I understand correctly, you want the following:
field1="?lcid=2401&mobile=false"
field2="-"
field3="TI.SI=0; TI=0; VARS=LCID=2401; VARSESSION=S=hjdhjehJJK%FJD44i2fjd%3d%3d&SLI=0&FIRSTSESSION=1&ITT=0; ANCUUID=849nfdjgfvjsdfdjh73e4jfj; GGG=0; GHJMK=0"
field4="-"
Is this correct?
If the number of fields (extractions) is always the same, you could define a regex as follows:
"(?P
If the number of fields is not fixed, then the above won't work
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunk 5.0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What version of splunk are you using?
Introducing the Splunk Community Dashboard Challenge!
Wondering How to Build Resiliency in the Cloud?
Updated Data Management and AWS GDI Inventory in Splunk Observability
