topic Re: Regex parse message to multiple lines help in Getting Data In

Regex parse message to multiple lines help

kevincai79 — Tue, 14 Apr 2020 03:15:37 GMT

I have a below message:
[32minfo[39m: [Clean Storage] brand/market/testing1.html, brand/market/testing2.html, brand/market/testing3.html were successfully deleted from container stores-test

How do I use the splunk query to show the message as below:
brand market testing1.html
brand market testing2.html
brand market testing3.html

i've spent hours trying and I just could not got it right.

Thanks for your help.

Re: Regex parse message to multiple lines help

vnravikumar — Tue, 14 Apr 2020 08:47:27 GMT

Please use Code Sample or Ctrl + K to post your sample message.

Re: Regex parse message to multiple lines help

manjunathmeti — Tue, 14 Apr 2020 10:35:13 GMT

Use rex command with max_match=0. Try this.

| makeresults 
| eval _raw="[32minfo[39m: [Clean Storage] brand/market/testing1.html, brand/market/testing2.html, brand/market/testing3.html were successfully deleted from container stores-test" 
| rex max_match=0 "(?<message>[\w\/]+.html)" 
| mvexpand message 
| eval message=replace(message, "/", " ") 
| table message

Re: Regex parse message to multiple lines help

harishalipaka — Tue, 14 Apr 2020 10:35:21 GMT

Hi @kevincai79

try this --

|makeresults |eval hari="[32minfo[39m: [Clean Storage] brand/market/testing1.html, brand/market/testing2.html, brand/market/testing3.html were successfully deleted from container stores-test" |table hari |rex field=hari "\] (?<Newfield>.*) were" |eval hari=trim(split(Newfield,",")) |rex field=hari mode=sed "s/\// /g" |table hari