is it possible to have multiple expression in one state that are similar? I was hoping to group together a few expressions to make life easy for myself. i want to do something similar below but its not working and only recognise the 1st expr and although it does match the expr it doesnt save into the array using yytext. im guessing im doing something wrong so any help would be appreciated.Thanks
<some_state>"Milk;" |
"Honey;" |
"Cinnamon;" |
"Cardamon;" |
"Rum;" |
"Brandy;" |
"Whiskey;" |
"Aquavit;" |
"Kahula;" { printf("Example"); array[i].addition = yytext;BEGIN(amount_state);}
If flex is allowed, you can use start condition scope like the following:
<some_state>{
"Milk;" |
"Honey;" |
... |
"Kahula;" { printf("Example"); ... }
}
If only AT&T lex is allowed, unfortunately this may be invalid...
Related
I have a table of rows with cells containing multiple strings. Like this:
K1111=V1111;K1=V1;kv13_key4=--xxxxxsomething;id5=true;impid=23123123;location=domain_co_uk
I need to extract a substring that begins with kv13_key4= and ends with anything after but the lengths all vary and the substrings are all separated by a semicolon ; . I tried
REGEXP_EXTRACT(customtargeting,'%in2w_key4%;') As contains_key_Value
but didn't work. I need something like this:
| Original Cell | Extracted |
| key88=1811111;id89=9990string;K1=V1;23234234234tttttttt13_key4=--x;id5=true;impid=23123;url=domain_co_uk | kv13_key4=--x |
| K1111=V1111;K1=V1;kv13_key4=--xsomething;id5=true;impid=23123123;location=domain_co_uk | kv13_key4=--xsomething |
| ;id5=true;T6791=V1111;K1=V1;kv13_key4=--xxxxxsomething123;impid=23123 | kv13_key4=--xxxxxsomething123 |
Consider below
select *, regexp_extract(customtargeting, r'kv13_key4=[^;]+') as Extracted
from your_table
if applied to sample data in your question - output is
Does this regex work:
(?<=kv13_key4=)[^;]+(?=;)
It captures everything between 'kv13_key4=' and the nearest ';'
Your REGEX_EXTRACT would look like:
REGEXP_EXTRACT(customtargeting,r'(?<=kv13_key4=)[^;]+(?=;)')
I am just into learning of Splunk queries, I'm trying to grab a data from myfile.csv file based on the regex expression.
In particular, I'm looking forward, print only the rows where column fqdn not endswith udc.net and htc.com.
Below is my query which is working but i'm writing it twice.
| inputlookup myfile.csv
| regex support_group="^mygroup-Linux$"
| regex u_sec_dom="^Normal Secure$"
| regex fqdn!=".*?udc.net$"
| regex fqdn!=".*?htc.com$"
| where match(fqdn,".")
I am trying them to combine with | separeted but not working though...
| regex fqdn!="(.*?udc.net | ".*?htc.com)$"
You can do this with a search and where clause:
| inputlookup myfile.csv
| search support_group="mygroup-Linux" u_sec_dom="Normal Secure"
| where !match(fqdn,"udc.net$") AND !match(fqdn,"htc.com$")
Or just a single search clause:
| inputlookup myfile.csv
| search support_group="mygroup-Linux" u_sec_dom="Normal Secure" NOT (fqdn IN("*udc.net","*htc.com")
You can also rewrite the IN() thusly:
(fqdn="*udc.net" OR fqdn="*htc.com")
The combined regex will work if you omit the spaces on either side of the |. The extra spaces become part of the regex and prevent matches.
There's no need for the final where command. Splunk by default will display all events that match ..
I have a variable acusip that looks like this:
000000111111
I need to eliminate black spaces at the end.
I know this function, but do not know the command:
strrtrim("acusip ")="acusip"
Any idea how to solve this issue?
The following works for me:
clear
set obs 1
generate acusip1 = "000000111111 "
generate acusip2 = strtrim(acusip1)
list
+-----------------------------------+
| acusip1 acusip2 |
|-----------------------------------|
1. | 000000111111 000000111111 |
+-----------------------------------+
I have to find a pattern for matching only the URL's of a list like this:
one | two | three | four | http://www.site/whatever-the-site-uses
one | two | three | four | http://www.site/whatever-the-site-uses
one | two | three | four | http://www.site/whatever-the-site-uses
i need to grab the whole http or https inside a SINGLE GROUP but I can't get a good pattern for it
Can someone help me? So far, I have \|(.*?)/$, but the result is something like
| two | three | four | http://www.site/whatever-the-site-uses
Did I understand you right? From the last "| https://" capture the group staring with https? to the end of the line
Is this it?
/\|\ (https?\:\/\/.*)$/
In the Robot Framework library called String, there are several keywords that allow us to use a regexp to manipulate a string, but these manipulations don't seem to include selecting a substring from a string.
To clarify, what I intend is to have a price, i.e. € 1234,00 from which I would like to select only the 4 primary digits, meaning I am left with 1234 (which I will convert to an int for use in validation calculations). I have a regexp which will allow me to do that, which is as follows:
(\d+)[\.\,]
If I use Remove String Using Regexp with this regexp I will be left with exactly what I tried to remove. If I use Get Lines Matching Regexp, I will get the entire line rather than just the result I wanted, and if I use Get Regexp Matches I will get the right result except it will be in a list, which I will then have to manipulate again so that doesn't seem optimal.
Did I simply miss the keyword that will allow me to do this or am I forced to write my own custom keyword that will let me do this? I am slightly amazed that this functionality doesn't seem to be available, as this is the first use case I would think of when I think of using a regexp with a string...
You can use the Evaluate keyword to run some python code.
For example:
| Using 'Evaluate' to find a pattern in a string
| | ${string}= | set variable | € 1234,00
| | ${result}= | evaluate | re.search(r'\\d+', '''${string}''').group(0) | re
| | should be equal as strings | ${result} | 1234
Starting with robot framework 2.9 there is a keyword named Get regexp matches, which returns a list of all matches.
For example:
| Using 'Get regexp matches' to find a pattern in a string
| | ${string}= | set variable | € 1234,00
| | ${matches}= | get regexp matches | ${string} | \\d+
| | should be equal as strings | ${matches[0]} | 1234