topic Re: How do you extract out relevant message from _raw, trimming the timestamp part? in Splunk Search

How do you extract out relevant message from _raw, trimming the timestamp part?

jainkul123 — Tue, 29 Sep 2020 23:10:11 GMT

How can I trim the date timestamp from _raw. My _raw is as follows:

[1/13/19 10:18:20:577 GMT] 00000097 LogOut O INFO: Sun Jan 13 10:18:20 GMT 2019: **THIS IS MY MESSAGE STRING.* *

And I want to extract out just the message: THIS IS MY MESSAGE STRING.

Re: How do you extract out relevant message from _raw, trimming the timestamp part?

rshah_splunk — Wed, 06 Feb 2019 12:37:54 GMT

You can try using the below regular expression.

  \[.*\].*?\w{3}\s+\w{3}\s+\d{1,2}\s+\d{2}\:\d{2}\:\d{2}\s\S+\s+\d{4}\:\s+(?.*)

Demo: https://regex101.com/r/ze1Jxk/1

Re: How do you extract out relevant message from _raw, trimming the timestamp part?

renjith_nair — Wed, 06 Feb 2019 12:49:55 GMT

@jainkul123 ,

Give this a try,

"your search"|rex field=_raw "\w{3}\s\w{3}\s+\d{1,2}\s+\d{1,2}:\d{1,2}:\d{1,2}\s\w{3}\s\d{4}:\s(?<Message>.+)"

Re: How do you extract out relevant message from _raw, trimming the timestamp part?

tiagopeq — Wed, 06 Feb 2019 13:00:26 GMT

This was the most generic regex I could find with the amount of information you shared, while staying minimally efficient I'd say:

| makeresults count=1
| eval _raw="[1/13/19 10:18:20:577 GMT] 00000097 LogOut O INFO: Sun Jan 13 10:18:20 GMT 2019: THIS IS MY MESSAGE STRING."
| rex "\[\d*\/\d*\/\d* \d{2}:\d{2}:\d{2}:\d{3}[^\]]+\].*INFO:[^:]+:\d{2}:\d{2}[^:]+:(?<_raw>.*)"

Re: How do you extract out relevant message from _raw, trimming the timestamp part?

jainkul123 — Sun, 10 Feb 2019 18:14:12 GMT

This works, thank you

Re: How do you extract out relevant message from _raw, trimming the timestamp part?

skoelpin — Sun, 10 Feb 2019 19:57:22 GMT

If it works you should accept it to close out the question