topic Regex not working for multiline events in Splunk Search

Regex not working for multiline events

namrithadeepak — Sun, 11 Aug 2019 15:12:02 GMT

Hi,

My logs look like this ...

AS RAW TEXT:

{"timestamp":"2019-08-08 10:23:38.320","level":"INFO","thread":"task-scheduler-8","mdc":{"TraceabilityID":"abcde","file_name":"MySampleFileName.json","Source":"SOURCE"},"logger":"MyApplicationLogConfig","message":" |IN001 |1010908 |Order placed Successfully. |\n |IN002 |1010909 |Order placed Successfully. |\n"}

SYNTAX HIGHLIGHTED:

WHAT I NEED:
1010908, 1010909 extracted as the OrderNum, Order placed Successfully as OrderStatus.

REGEX:

| rex field=message "(\n\s)*\|IN\d+\s\|(?<orderNum>\d+)\s\|(?<orderStatus>[\w\s]+)\.\s\|(\n)?"

ERROR IS:
The regex extracts only '1010908' as the OrderNum. I want both 1010908, 1010909 to be extracted.

Thanks in advance.

Re: Regex not working for multiline events

Sukisen1981 — Sun, 11 Aug 2019 15:17:11 GMT

can you paste the event as text , without a screen shot? that way we can work with the extraction

Re: Regex not working for multiline events

Sukisen1981 — Sun, 11 Aug 2019 15:46:09 GMT

if you just append a max_match=0 , liker this to your regex, is it what you expect?

| rex field=message "(\n\s)*\|IN\d+\s\|(?<orderNum>\d+)\s\|(?<orderStatus>[\w\s]+)\.\s\|(\n)?" max_match=0

Re: Regex not working for multiline events

woodcock — Sun, 11 Aug 2019 20:27:52 GMT

You need max_match=0, like this:

| makeresults
| eval _raw = "{\"timestamp\":\"2019-08-08 10:23:38.320\",\"level\":\"INFO\",\"thread\":\"task-scheduler-8\",\"mdc\":{\"TraceabilityID\":\"abcde\",\"file_name\":\"MySampleFileName.json\",\"Source\":\"SOURCE\"},\"logger\":\"MyApplicationLogConfig\",\"message\":\" |IN001 |1010908 |Order placed Successfully. |\n |IN002 |1010909 |Order placed Successfully. |\n\"}"
| spath
| rex field=message max_match=0 "(\n\s)*\|IN\d+\s\|(?<orderNum>\d+)\s\|(?<orderStatus>[\w\s]+)\.\s\|(\n)?"