topic Re: Regex in splunk in Splunk Search

Regex in splunk

malgru — Mon, 20 Apr 2020 12:39:47 GMT

Hello

I am trying to get a regex to work in splunk but without success, perhaps someone here can help me?

This work when I am testing (not in splunk)

", logdata="Process Code: -400
Process Message: [0]:ABC QRT 12764 NOT. <-PurchaseOrderLineId- HeadId:1415640 Division:10 Id:1-1>", marowver="7"

But how do I get an expression that works in Splunk? I want the string in bold: ABC QRT 12764 NOT

richgalloway — Mon, 20 Apr 2020 13:16:52 GMT

It would help to see your existing regex efforts.

Perhaps this will help: Process Message: \[\d+]:(?<processMessage>[\w\s]+)

malgru — Mon, 20 Apr 2020 13:21:34 GMT

The regex that I got and work in other environments (Not Splunk ) is
(?<=Process Message)(.*)(?=<-DBTransaction)

Somehow it was not included in the my initial post

malgru — Mon, 20 Apr 2020 13:46:40 GMT

I just modified your example a little and it worked just fine, thanks

"(?<=Process Message:) \[\d+]:(?< basic_error_message>[\w\s]+)"