예제 #1
0
        results, dummyresults, settings = si.getOrganizedResults()
        values = []
        # for first N result used as training
        for result in results[:maxtrainers]:
            val = result.get(fromfield, None)
            if val != None:
                values.append(val)

        examples = [ex.strip() for ex in examples.split(",")]
        if badexamples == None:
            badexamples = []
        else:
            badexamples = [ex.strip() for ex in badexamples.split(",")]

        try:
            regexes, extractions = ifl.learn(values, examples, badexamples)
        except Exception, e:
            # log error
            stack = traceback.format_exc()
            logger.error("Exception encountered: %s" % e)
            logger.info("Traceback: %s" % stack)
            # just tell user that we couldn't extract anything
            regexes = ""

        if len(regexes) == 0:
            si.generateErrorResults(
                'Unable to learn any extractions.  Provide different examples, counterexamples, or searchresults'
            )
            exit(0)

        rex = regexes[0]
예제 #2
0
 if args['edited']:
     regex = args['regex']
     # args['examples'] = []
     args['counterexamples'] = []
 else:
     try:
         # run through user examples, to see if the user specified multiple values per example
         seenMultipleValues = False
         for exampleSet in examples:
             vals = splitExampleValues(exampleSet)
             if len(vals) > 1:
                 seenMultipleValues = True
                 break
         # if no multiple values, use standard ifx learning
         if not seenMultipleValues:
             regexes, extractions = ifl.learn(events, examples, args['counterexamples'])
             if len(regexes) > 0:
                 regex = regexes[0]
         else: # if multiple values, use in multivalue ifx
             counterExamples = args['counterexamples']
             # !! hack
             counterExamples = { 'field0': counterExamples } 
             sourceField = "_raw"
             markedEvents = {}
             for i, event in enumerate(events):
                 markedEvent = {}
                 raw = event
                 markedEvent["_event"] = { sourceField : raw } 
                 for exampleSet in examples:
                     #  !! hack
                     pos = 0
예제 #3
0
파일: erex.py 프로젝트: DRArpitha/splunk
        results,dummyresults,settings = si.getOrganizedResults()
        values = []
        # for first N result used as training
        for result in results[:maxtrainers]:
            val = result.get(fromfield, None)
            if val != None:
                values.append(val)

        examples = [ex.strip() for ex in examples.split(",")]
        if badexamples == None:
            badexamples = []
        else:
            badexamples = [ex.strip() for ex in badexamples.split(",")]

        try:
            regexes, extractions = ifl.learn(values, examples, badexamples)
        except Exception, e:
            # log error
            logger.error("%s" % e)
            logger.info("Traceback: %s" % stack)
            # just tell user that we couldn't extract anything
            regexes = ""

        if len(regexes) == 0:
            si.generateErrorResults('Unable to learn any extractions.  Provide different examples, counterexamples, or searchresults') 
            exit(0)

        rex = regexes[0]

        rex = rex.replace("?P<FIELDNAME>", "?P<%s>" % keywords[0])
        si.addInfoMessage(messages, 'Successfully learned regex.  Consider using: | rex "%s"' % rex.replace('"', '\\"'))
예제 #4
0
 if args['edited']:
     regex = args['regex']
     # args['examples'] = []
     args['counterexamples'] = []
 else:
     try:
         # run through user examples, to see if the user specified multiple values per example
         seenMultipleValues = False
         for exampleSet in examples:
             vals = splitExampleValues(exampleSet)
             if len(vals) > 1:
                 seenMultipleValues = True
                 break
         # if no multiple values, use standard ifx learning
         if not seenMultipleValues:
             regexes, extractions = ifl.learn(events, examples, args['counterexamples'])
             if len(regexes) > 0:
                 regex = regexes[0]
         else: # if multiple values, use in multivalue ifx
             counterExamples = args['counterexamples']
             # !! hack
             counterExamples = { 'field0': counterExamples } 
             sourceField = "_raw"
             markedEvents = {}
             for i, event in enumerate(events):
                 markedEvent = {}
                 raw = event
                 markedEvent["_event"] = { sourceField : raw } 
                 for exampleSet in examples:
                     #  !! hack
                     pos = 0