topic Re: Why is the rex capture not working? in Splunk Search

Why is the rex capture not working?

nareshkumar1985 — Tue, 03 Sep 2019 15:02:14 GMT

Hi All,
I am trying to capture line starting with a number, I have created a regex and tested it in regex101 site and it is working as expected but when I used the same in Splunk using rex it is failing to capture and the result is blank.

https://regex101.com/r/OLUh4A/1

Text:

Cluster GUID: xxxxxxxxxxxxxxx
Sender OneFS Version: Isilon OneFS v8.0.0.6 B_MR_8_0_0_6_117(RELEASE)
Sender Serial Number: xxxxxxx


Node 5 Eventgroups
------------------------------------------------------------------------
OneFS Version: Isilon OneFS v8.0.0.6 B_MR_8_0_0_6_117(RELEASE)
Serial Number: xxxxxxxx
------------------------------------------------------------------------
ID           Started        Sev  Message
------------------------------------------------------------------------
136486 09/02 03:33    I    SmartQuotas threshold violation on quota exceeded, 
domain directory /xx/xxxxxxx/NAM/xxxxx/xxxxxx/Cisco


Attachment Manifest:
Attached:
events-000e1ea5fexxxxxx-xxxxxxxxx.xml
quotaexceeded.35738

 - events-000e1eaxxxxxxxxdccc983-xxxxxx.xml - 
quotaexceeded.35738

Regex used : [\s\S]*(?<ID>^\d{1,})\s(?<time>\d{2}\/\d{2}\s\d{2}:\d{2})\s{1,}(?<sev>\w)\s{1,}(?<message>[\s\S]*)Attachment\sManifest:[\s\S]*

Re: Why is the rex capture not working?

gcusello — Tue, 03 Sep 2019 15:30:03 GMT

Hi nareshkumar1985,
did you already tried to add (?ms) at the beginning of your regex?

bye.
Giuseppe

Re: Why is the rex capture not working?

nareshkumar1985 — Tue, 03 Sep 2019 15:37:26 GMT

Hi Giuseppe,

Thanks after adding it working, could you please let me know the purpose of adding (?ms) at the beginning of the regex.

Regards,
Naresh

Re: Why is the rex capture not working?

gcusello — Tue, 03 Sep 2019 15:42:51 GMT

in regex101 there are (on the right of the regex box) the regex options (/gm) that you need to insert in your regex in Splunk.
Bye.
Giuseppe

Re: Why is the rex capture not working?

nareshkumar1985 — Tue, 03 Sep 2019 17:49:31 GMT

Thank you, Giuseppe