Splunk regex ignore fields before match

leandromatperei — Thu, 02 Dec 2021 20:20:03 GMT

I need to extract the contents of the message field, but the first strings must be ignored, I need to get from the stdout field.
Any ideas how to do this?

Examples:

message: 2021-12-02T20:06:11.541111542Z stdout F 2021-12-02 17:06:11,540 Completed 200 OK message: 2021-12-02T20:06:11.540863953Z stdout F contract: txt (truncated)...] message: 2021-12-02T20:06:11.540857713Z stdout F clientDocument: txt

Re: Splunk regex ignore fields before match

ITWhisperer — Thu, 02 Dec 2021 20:26:53 GMT

| rex "message:.+stdout (?<stdout>.+)"

topic Splunk regex ignore fields before match in Splunk Enterprise

Splunk regex ignore fields before match

Re: Splunk regex ignore fields before match