How to handle \n in regex

ppatkar — Wed, 03 Mar 2021 16:09:38 GMT

In some of the events, I have '\n' in the events :

message: org.springframework.jdbc.UncategorizedSQLException: CallableStatementCallback; uncategorized SQLException for SQL <{call XYZ_API.PROCESS_EVENT(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)}>; SQL state <16000>; error code <20011>; ORA-00060: deadlock detected while waiting for resource\nORA-06512: at "ABC_OWNER.XYZ_API", line 5133\nORA-06512: at "ABC_OWNER.XYZ_API", line 2001\nORA-06512: at "ABC_OWNER.XYZ_API", line 6829\nORA-06512: at line 1\n; nested exception is java.sql.SQLException: ORA-00060: deadlock detected while waiting for resource\nORA-06512: at "ABC_OWNER.XYZ_API", line 5133\nORA-06512: at "ABC_OWNER.XYZ_API", line 2001\nORA-06512: at "ABC_OWNER.XYZ_API", line 6829\nORA-06512: at line 1\n'

Although my regex (message:\s(?<METADATA_ERROR>[^\\\n]+)) to extract until the first '\n' appears in the event works :

https://regex101.com/r/XwEg29/1

When I try on Splunk, it extracts only 'org.spri'

Do we need to handle \n differently in Splunk ?

Re: How to handle \n in regex

ITWhisperer — Wed, 03 Mar 2021 17:16:03 GMT

You need a couple more backslashes

(message:\s(?<METADATA_ERROR>[^\\\\\n]+))

topic Re: How to handle \n in regex in Splunk Search

How to handle \n in regex

Re: How to handle \n in regex