How to match all lines with common pattern in splunk regex - regex

I am trying to extract a report of all incidents matching a certain pattern and then need to plot how many occurances of each type. For example the below lines.
File: ../../../transfer/200.FILETYPE1.0000003115.20160419-082708-089.xml successfully imported.
some other logs....
File: ../../../transfer/200.FILETYPE1.0000003116.20160419-082708-090.xml successfully imported.
some other logs...
File: ../../../transfer/201.FILETYPE2.0000003117.20160419-082708-091.xml successfully imported.
Please note that there are many filetypes but the pattern is same "/transfer/" prefix and "successfully imported." suffix and these prefix and suffix must match as other lines may also contain same file name before completion.
So in above case I need to find all such occurrences of above lines and find count of each FILETYPE1 and FILETYPE2 in splunk.
Can someone help me with regex that can match above pattern and give me all such lines so that I can extract counts of each file type?

Straight forward:
^File:.*FILETYPE\d.*$
# ^ beginning of the line
# File: literally
# .* anything to the end of the line
# FILETYPE + a number literally
# .* anything afterwards
# $ the end of the line
See a demo on regex101.com.
Hint: If you only have these two strings (FILETYPE1 and FILETYPE2) you might be faster with string functions only.

Edit FILETYPE1/FILETYPE2 for counting
\.\.\/.*\/\d+\.FILETYPE1\..*?\.xml
Regex demo

Try this one:
\/transfer\/.*FILETYPE(\d+).*successfully imported
The file type number will be captured by the capture group, so you can count the file occurrences
Regex Demo

Related

Regex match if string contains new line OR if it does not (multi-line)

I am trying to parse log files where some of them are single line logs, some are multiline. The regex I have works fine for single lines but not for multi-lines.
^(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+\.\d+(\+|-)\d+:\d+)\s+\[(?<severity>\w+)\](?<message>.*)$
This is where the match is failing because it does not detect the string after the new line.
2022-06-27T15:22:35.508+00:00 [Info] New settings received:
{"indexer.settings.compaction.days_of_week":"Sunday,Monday"}
The new line should be included in the "message" group until it detects a new timestamp.
I tried multiple approaches to include the newline to be matched but didn't find any solution yet. I have pasted both log formats in the link: https://regex101.com/r/ftJ3UZ/1.
If a lookahead is supported, you can put an optional repeating group in the message group checking that the next line does not start with a datelike pattern, or the full timestamp.
^(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+\.\d+([+-])\d+:\d+)\s+\[(?<severity>\w+)\](?<message>.*(?:\n(?!\d+-\d+-\d+T).*)*)$
Regex demo
It seems this would match:
^(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+\.\d+(\+|-)\d+:\d+)\s+\[(?<severity>\w+)\](?<message>.*)\n(?:{.*})?
I've removed $ and added \n(?:{.*})? to the end to be able to match optional part inside {} braces.

Regular expression to search multiple strings (Textpad)

I'm a bit new to regex and am looking to search for multiple lines/instaces of some wildcard strings such as *8768, *9875, *2353.
I would like to pull all instances of these (within one file) rather than searching them individually.
Any help is greatly appreciated. I've tried things such as *8768,*9875 etc...
If I understand what you are asking, it is a regular expression like this:
^(8768|9875|2353)
This matches the three sets of digit strings at beginning of line only.
To get the lines that contain the texts 8768, 9875 or 2353, use:
^.*(8768|9875|2353).*$
What it means:
^ from the beginning of the line
.* get any character except \n (0 or more times)
(8768|9875|2353) if the line contains the string '8768' OR '9875' OR '2353'
.* and get any character except \n (0 or more times)
$ until the end of the line
If you do want the literal * char, you'd have to escape it:
^.*(\*8768|\*9875|\*2353).*$
I suggest much better solution. Task in my case: add http://google.com/ path before each record and import multiple fields.
CSV single field value (all images just have filenames, separate by |):
"123.jpg|345.jpg|567.jpg"
Tamper 1st plugin: find and replace by REGEXP:
pattern: /([a-zA-Z0-9]*)./
replacement: http://google.com/$1
Tamper 2nd plugin: explode
setting: explode by |
In this case you don't need any additinal fields mappings and can use 1 field in CSV

Regex to match this

I'm trying to capture from PHPUnit output the file path and the error line with a condition.
I don't want want lines that contain the whole word exception (can I exclude multiple words?).
This is my output and non-working (obviously:) pattern:
/path/includes/exception.php:7
/path/things-i-care-about/es/somefile.php:132
/path/things-i-care-about/es/somefile.php:121
/path/things-i-care-about/es/somefile.php:54
/path/things-i-care-about/es/somefile.php:60
/path/things-i-care-about/es/somefile.php:41
/path/things-i-care-about/es/somefile.php:47
/path/things-i-care-about/testfile.php:26
Pattern: /((?!exception).*.php):(\d.*)/gs
What I tried is negating any line that has "exception" in it, but my regex didn't quite work.
What am I doing wrong?
You can try this pattern:
^(?:[^e\n]+|\Be|\be(?!xception\b))+\.php:\d+$
or this pattern, if you don't need to check a specific line format:
^(?>[^e\n]++|\Be|\be(?!xception\b))+$
Notice: If you need to select all consecutive lines in one block, you just need to remove \n from the character classes.

Regular expression get filename without extention from full filepath

How can I extract the filename without extention from the following file path:
D:\Projects\Extract\downtown - second.pdf
The following regular expression gives me the filename with extention: [^\\]*$
e.g. downtown - second.pdf
The following regular expression gives me the filename without extention: (.+)(?=(\.))
e.g. D:\Projects\Extract\downtown - second
I'm struggling to combine the two into one regular expression to give me the results I want: downtown - second
I suspect that your 2nd regex would not give you the output you have shown. It will give you the complete string till the first period (.).
To get just the file name without extension, you can use this regex: -
[^\\]*(?=[.][a-zA-Z]+$)
I have just replaced (.+) in your 2nd regex with the [^\\]* from your first regex, and added pattern to match pdf till the end.
Now this pattern will match 0 or more repetition of any character but backslash(\), followed by a . and then 1 or more repetition of alphabets making up extension.
I made up this one, which allows to capture most of the possibilities:
/[^\\\/]+(?=\.[\w]+$)|[^\\\/]+$/
/path/to/file
/path/to/file.txt
/path.with/dots.to/file.txt
/path/to/file.with.dots.txt
file.txt
C:\path\to\file.txt
and so on...
I captured file from /path/to/file.pdf by using following regex:
[^/]*(?=\.[^.]+($|\?))
Hope this helps you
I had to use an extra backslash before the first ']' to make this work
[^\\\]*(?=[.][a-zA-Z]+$)
I use this pattern
[^\/]+[.+\.].*$ for / path separator
[^\\]+[.+\.].*$ for \ path separator
hich matches the filename at the end of the string without worrying about characters. There is one exception that if the path for some reason has a folder with a period in it this will get upset. Linux hidden directories that are preceded with a . like .rvm are unaffected.
Hope this helps.
http://rubular.com/r/LNrI4inMU1

Regex for extracting filename from path

I need to extract just the filename (no file extension) from the following path....
\\my-local-server\path\to\this_file may_contain-any&character.pdf
I've tried several things, most based off of something like http://regexr.com?302m5 but can't quite get there
^\\(.+\\)*(.+)\.(.+)$
This regex has been tested on these two examples:
\var\www\www.example.com\index.php
\index.php
First block "(.+\)*" matches directory path.
Second block "(.+)" matches file name without extension.
Third block "(.+)$" matches extension.
This will get the filename but will also get the dot. You might want to truncate the last digit from it in your code.
[\w-]+\.
Update
#Geoman if you have spaces in file name then use the modified pattern below
[ \w-]+\. (space added in brackets)
Demo
This is just a slight variation on #hmd's so you don't have to truncate the .
[ \w-]+?(?=\.)
Demo
Really, thanks goes to #hmd. I've only slightly improved on it.
Try this:
[^\\]+(?=\.pdf$)
It matches everything except back-slash followed by .pdf at the end of the string.
You can also (and maybe it's even better) take the part you want into the capturing group like that:
([^\\]+)\.pdf$
But how you refer to this group (the part in parenthesis) depends on the language or regexp flavor you're using. In most cases it'll be smth like $1, or \1, or the library will provide some method for getting capturing group by its number after regexp match.
I use #"[^\\]+$"
That gives the filename including the extension.
I'm using this regex to replace the filename of the file with index. It matches a contiguous string of characters that doesn't contain a slash and is followed by a . and a string of word characters at the end of the string. It will retrieve the filename including spaces and dots but will ignore the full file extension.
const regex = /[^\\/]+?(?=\.\w+$)/
console.log('/path/to/file.png'.match(regex))
console.log('/path/to/video.webm'.match(regex))
console.log('/path/to/weird.file.gif'.match(regex))
console.log('/path with/spaces/and file.with.spaces'.match(regex))
If anyone is looking for a windows absolute path (and relative path) javascript regular expression in javascript for files:
var path = "c:\\my-long\\path_directory\\file.html";
((/(\w?\:?\\?[\w\-_\\]*\\+)([\w-_]+)(\.[\w-_]+)/gi).exec(path);
Output is:
[
"c:\my-long\path_directory\file.html",
"c:\my-long\path_directory\",
"file",
".html"
]
Here's a slight modification to Angelo's excellent answer that allows for spaces in the path, filename and extension as well as missing parts:
function parsePath (path) {
var parts = (/(\w?\:?\\?[\w\-_ \\]*\\+)?([\w-_ ]+)?(\.[\w-_ ]+)?/gi).exec(path);
return {
path: parts[0] || "",
folder: parts[1] || "",
name: parts[2] || "",
extension: parts[3] || "",
};
}
If you want to return the file name with its extension, Regex should be as below:
[A-Za-z0-9_\-\.]+\.[A-Za-z0-9]+$
works for
path/to/your/filename.some
path/to/your/filename.some.other
path\to\your\filename.some
path\to\your\filename.some.other
http://path/to/your/filename.some
http://path/to/your/filename.some.other
And so on
Which returns full file name with extension(eg: filename.some or filename.some.other)
If you want to return file name without the last extension Regex should be as below:
[A-Za-z0-9_\-\.]+(?=\.[A-Za-z0-9]+$)
Which returns full file name without last extension(eg: "filename" for "filename.some" and "filename.some" for "filename.some.other")
Click the Explain button on these links shown TEST to see how they work.
This is specific to the pdf extension.
TEST ^.+\\([^.]+)\.pdf$
This is specific to any extension, not just pdf.
TEST ^.+\\([^.]+)\.[^\.]+$
([^.]+)
This is the $1 capture group to extract the filename without the extension.
\\my-local-server\path\to\this_file may_contain-any&character.pdf
will return
this_file may_contain-any&character
TEST ^(.*[\\\/])?(.*?)(\.[^.]*?|)$
example:
/^(.*[\\\/])?(.*?)(\.[^.]*?|)$/.exec("C:\\folder1\\folder2\\foo.ext1.ext")
result:
0: "C:\folder1\folder2\foo.ext1.ext"
1: "C:\folder1\folder2\"
2: "foo.ext1"
3: ".ext"
the $1 capture group is the folder
the $2 capture group is the name without extension
the $3 capture group is the extension (only the last)
works for:
C:\folder1\folder2\foo.ext
C:\folder1\folder2\foo.ext1.ext
C:\folder1\folder2\name-without extension
only name
name.ext
C:\folder1\folder2\foo.ext
/folder1/folder2/foo.ext
C:\folder1\folder2\foo
C:\folder1\folder2\
C:\special&chars\folder2\f [oo].ext1.e-x-t
Answer with:
File name and directory space support
Named capture group
Gets unlimited file extensions (captures file.tar.gz, not just file.tar)
*NIX and Win support
^.+(\\|\/)(?<file_name>([^\\\/\n]+)(\.)?[^\n\.]+)$
Explanation:
^.+(\\|\/) Gets anything up to the final / or \ in a file path
(?<file_name> Begin named capture group
([^\\\/\n]+) get anything except for a newline or new file
(\.)?[^\n\.]+ Not really needed but it works well for issues with odd characters in file names
)$ End named capture group and end line
Note that if you're putting this in a string and you need to escape backslashes (such as with C) you'll be using this string:
"^.+(\\\\|\/)(?<file_name>([^\\\/\n]+)(\.)?[^\n\.]+)$"
Here is an alternative that works on windows/unix:
"^(([A-Z]:)?[\.]?[\\{1,2}/]?.*[\\{1,2}/])*(.+)\.(.+)"
First block: path
Second block: dummy
Third block: file name
Fourth block: extension
Tested on:
".\var\www\www.example.com\index.php"
"\var\www\www.example.com\index.php"
"/var/www/www.example.com/index.php"
"./var/www/www.example.com/index.php"
"C:/var/www/www.example.com/index.php"
"D:/var/www/www.example.com/index.php"
"D:\\var\\www\\www.example.com\\index.php"
"\index.php"
"./index.php"
This regular expression extract the file extension, if group 3 isn't null it's the extension.
.*\\(.*\.(.+)|.*$)
also one more for file in dir and root
^(.*\\)?(.*)(\..*)$
for file in dir
Full match 0-17 `\path\to\file.ext`
Group 1. 0-9 `\path\to\`
Group 2. 9-13 `file`
Group 3. 13-17 `.ext`
for file in root
Full match 0-8 `file.ext`
Group 2. 0-4 `file`
Group 3. 4-8 `.ext`
For most of the cases ( that is some win , unx path , separator , bare file name , dot , file extension ) the following one is enough:
// grap the dir part (1), the dir sep(2) , the bare file name (3)
path.replaceAll("""^(.*)[\\|\/](.*)([.]{1}.*)""","$3")
Direct approach:
To answer your question as it's written, this will provide the most exact match:
^\\\\my-local-server\\path\\to\\(.+)\.pdf$
General approach:
This regex is short and simple, matches any filename in any folder (with or without extension) on both windows and *NIX:
.*[\\/]([^.]+)
If a file has multiple dots in its name, the above regex will capture the filename up to the first dot. This can easily be modified to match until the last dot if you know that you will not have files without extensions or that you will not have a path with dots in it.
If you know that the folder will only contain .pdf files or you are only interested in .pdf files and also know that the extension will never be misspelled, I would use this regex:
.*[\\/](.+)\.pdf$
Explanation:
. matches anything except line terminators.
* repeats the previous match from zero to as many times as possible.
[\\/] matches a the last backslash or forward slash (previous ones are consumed by .*). It is possible to omit either the backslash or the forward slash if you know that only one type of environment will be used.
If you want to capture the path, surround .* or .*[\\/] in parenthesis.
Parenthesis will capture what is matched inside them.
[^.] matches anything that is not a literal dot.
+ repeats the previous match one or more times, as many as possible.
\. matches a literal dot.
pdf matches the string pdf.
$ asserts the end of the string.
If you want to match files with zero, one or multiple dots in their names placed in a variable path which also may contain dots, it will start to get ugly. I have not provided an answer for this scenario as I think it is unlikely.
Edit: To also capture filenames without a path, replace the first part with (?:.*[\\/])?, which is an optional non-capturing group.
Does this work...
.*\/(.+)$
Posting here so I can get feedback
Here a solution to extract the file name without the dot of the extension.
I begin with the answer from #Hammad Khan and add the dot in the search character. So, dots can be part of the file name:
[ \w-.]+\.
Then use the regex look ahead(?= ) for a dot, so it will stop the search at the last dot (the dot before the extension), and the dot will not appears in the result:
[ \w-.]+(?=[.])
reorder, it's not necessary but look better:
[\w-. ]+(?=[.])
try this
[^\\]+$
you can also add extension for specificity
[^\\]+pdf$