splunk - regex to match some string -
i working project need match string in output..
here sample:
user code timestamp action name s#tplc field name user code group profile snglask 2012-05-30-20.33.53.003000 insert user test5 display snglask 2012-05-23-22.06.44.422000 change password rso part u lerapr sngchis full_auth snglask 2012-05-30-20.34.39.066000 insert user group profil *none basically have application need understand each row after space belong next column. then, after action name can treated other. hence, have come out regex format below:
regex = ^([^\s]+)\s+([^\s]+)\s+([^\s]+)s(.*)$ format = usercode::"$1" timestamp::"$2" actionname::"$3" others::"$4" the strategy recognize string ignore space after that. however, thing work until action name might space between action name. hence, problem is, how use regex let recognize string within action name need "insert user" input & "change password rso part" input.
do multipart words this:
((\s+\s)+) which says 1 or more word, separated 1 space. regex whould be:
^((\s+\s)+)\s+(\s+)\s+((\s+\s)+)\s+(.*)$
Comments
Post a Comment