splunk - regex to match some string -


i working project need match string in output..

here sample:

user code   timestamp                   action name                 s#tplc field name  user code group profile               snglask     2012-05-30-20.33.53.003000  insert user                                  test5       display snglask     2012-05-23-22.06.44.422000  change password rso part    u     lerapr      sngchis     full_auth snglask     2012-05-30-20.34.39.066000  insert user group profil                                *none 

basically have application need understand each row after space belong next column. then, after action name can treated other. hence, have come out regex format below:

regex = ^([^\s]+)\s+([^\s]+)\s+([^\s]+)s(.*)$ format = usercode::"$1" timestamp::"$2" actionname::"$3" others::"$4" 

the strategy recognize string ignore space after that. however, thing work until action name might space between action name. hence, problem is, how use regex let recognize string within action name need "insert user" input & "change password rso part" input.

do multipart words this:

((\s+\s)+) 

which says 1 or more word, separated 1 space. regex whould be:

^((\s+\s)+)\s+(\s+)\s+((\s+\s)+)\s+(.*)$ 

Comments

Popular posts from this blog

java - Play! framework 2.0: How to display multiple image? -

gmail - Is there any documentation for read-only access to the Google Contacts API? -

php - Controller/JToolBar not working in Joomla 2.5 -