topic Re: Help required on regex in Dashboards & Visualizations

Help required on regex

rangarbus — Wed, 26 May 2021 03:56:16 GMT

Hello Friends,

I am looking for your help for a rex expression.

message = [2021-05-26 00:00:33,477] {taskinstance.py:669} INFO - Dependencies all met for <TaskInstance: example_dag_oidc.test_bash 2021-05-25 00:00:00+00:00 [None]>

I would like to split this message field as below fields:

logDateTime = 2021-05-26 00:00:33,477
logLevel = INFO
logMessage = Dependencies all met for <TaskInstance: example_dag_oidc.test_bash 2021-05-25 00:00:00+00:00 [None]>

Thanks

Re: Help required on regex

eddieddieddie — Wed, 26 May 2021 04:21:19 GMT

Try the following regex with the rex command:

"\[(?<logDateTime>[\d, :,-]+)\].+ (?<logLevel>\w+) - (?<logMessage>.+)"

In Splunk SPL it would look like this (assuming that the raw data is in a field called 'message'):

| rex field=message "\[(?<logDateTime>[\d, :,-]+)\].+ (?<logLevel>\w+) - (?<logMessage>.+)" | table logDateTime logLevel logMessage

Hopefully that suits your needs?

Eddie