Need to extract and re-format with RegEx

user_289135 0
Viewed 15741

I'm using Splunk to parse some logs that have our "hub" and "comp" IDs embedded in them, down in the body of the message. I need to use a field extraction RegEx to pull them out in the form: HHHH-CCCC where the data appears like this: 

Hub:[HHHH] Comp: [HHHH]

Here's an example record:

RecordID:[00UJ9ANUHO5551212] TrackingID:[1234ANUHO5551212] Hub:[0472] Comp:[N259] Some event occurred, the log is in here::[\server\share\0472\N258\blah\blah\blah\somefile.txt], No exceptions raised.

From that, I'd like to return:

0472-N259

I'm trying to learn (re-learn! I learned this stuff 30 years ago!) capturing groups, and came up with this: 

(?<=Hub:\[)([A-Z0-9]{4})

From that I can get the 4 characters for the hub, but it won't let me do:

(?<=Hub:\[)([A-Z0-9]{4})  (?<=Comp:\[)([A-Z0-9]{4})

I'm kind of close, but am getting frustrated and it's time to go home, so I thought maybe SO could help me out overnight. 100 bounty for the best answer (please explain the solution). I promise to come back and award when this question is eligible. Answer doesn't have to be in splunk form (with <fieldname>) but that's helpful too.

It's helpful if the RegEx can be pasted into http://gskinner.com/RegExr/ so I can experiment further.

splunk regex
6 Answers

Have a look at this regex:

(?:Hub|Comp):\[[A-Z0-9]{4}\]

Description

Regular expression visualization

Demo

http://regexr.com?37gkh

There is more

You can match a whole line: ^(.*?)(Hub:\[[A-Z0-9]{4}\])(.*?)(Comp:\[[A-Z0-9]{4}\])(.*?)$. And then replace this line with this: $2-$4. I assume Hub always come before Comp.

user_3635730

You were close. Try capturing you targets:

Hub:\[([A-Z0-9]{4}) Comp:\[([A-Z0-9]{4})

Then use groups in your output:

$1-$2

Note that I am unfamiliar with splunk, so the syntax for groups may be the backslashes variety, ie \1-\2

user_2561960

You can do this (if I understand well):

pattern: Hub:\[([^\]]+)\] Comp:\[([^\]]+)\]
replacement: $1-$2

[^\]] means all characters except ]

The pattern can be shorten to : Hub:\[([^]]+)\] Comp:\[([^]]+)] with regex flavors that don't need to escape closing square brackets.

Your approach doesn't work since you use lookbehinds that are zero-width assertions and don't match anything.

user_22550890
Related