Splunk搜索Regex:以筛选时间戳和用户ID

Question

下面的文本想要提取时间戳，该时间戳与下面一行的UserId对齐，并将其分组为

2020-10-12 12:30:22.540  INFO 1 --- [enerContainer-4] c.t.t.o.s.s.UserPrepaidService       : Validating the user with UserID:1111 systemID:sys111 

从下面的完整日志

2020-10-12 12:30:22.538  INFO 1 --- [ener-4] c.t.t.o.s.service.UserService        :    AccountDetails":[{"snumber":"2222","sdetails":[{"sId":"0474889018","sType":"Java","plan":[{"snumber":"sdds22"}]}]}]}
2020-10-12 12:30:22.538  INFO 1 --- [ener-4] c.t.t.o.s.service.ReceiverService        : Received userType is:Normal
2020-10-12 12:30:22.540  INFO 1 --- [enerContainer-4] c.t.t.o.s.s.UserPrepaidService       : Validating the user with UserID:1111 systemID:sys111 
2020-10-12 12:30:22.540  INFO 1 --- [enerContainer-4] c.t.t.o.s.util.CommonUtil                : The  Code is valid for userId: 1111 systemId: sys111
2020-10-12 12:30:22.577  INFO 1 --- [enerContainer-4] c.t.t.o.s.r.Dao        : Saving user into dB ..... with User-ID:1111

同一重复线

下面是我的SPL搜索命令，它只返回特定行中的userid groupby。

但我也想要这行的时间戳，并用时间图分组

index="tis" logGroup="/ecs/logsmy" "logEvents{}.message"="*Validating the user with UserID*" | spath output=myfield path=logEvents{}.message | rex field=myfield "(?<=Validating the user with UserID:)(?<userId>[0-9]+)(?= systemID:)" |  table userId | dedup userId | stats count values(userId) by userId

基本上我厌倦了下面的

(^(?<dtime>d{4}-d{1,2}-d{1,2}s+d{1,2}:d{1,2}:d{1,2}.d+) )(?<=Validating the user with UserID:)(?<userId>[0-9]+)(?= systemID:)

但它给出了所有的时间戳，而不是我上面提到的

Answer 1

您在匹配时间戳模式后立即放置了lookaround，但必须首先移动到lookaround为true的位置。

如果同时需要这两个值，则可以匹配Validating the user with UserID:和systemID:，而不是使用环视。

如果有前导whitspace字符，可以将它们与s或[^Srn]*进行匹配

^s*(?<dtime>d{4}-d{1,2}-d{1,2}s+d{1,2}:d{1,2}:d{1,2}.d+).*bValidating the user with UserID:(?<userId>[0-9]+) systemID:

Regex演示