topic Re: REX for Multilined event + extract where line where match is found in Splunk Search

REX for Multilined event + extract where line where match is found

arrowecssupport — Tue, 29 Sep 2020 10:49:01 GMT

My splunk system is reading in logs as mutli lined events which is by design. So 1 event could have 300 lines or so.

Here is an extract from that long log file of 3 HDDs 1 of which is faulty.

15.5 : DRACKA    z159_BHIFIJFOKFO xx01 5538.5GB 512B/sect (P78J4Dk)
15.6 : DRACKA    z159_BHIFIJFOKFO xx01 6538.5GB 512B/sect (Failed)
15.7 : DRACKA    z159_BHIFIJFOKFO xx01 6538.5GB 512B/sect (PJ5F4Dk)

I need a REX that will extract to a field ONLY the middle line. The REX will be used in field extractor.

Extracted field could be called "failed_disk_error" and the result would be

15.6 : DRACKA    z159_BHIFIJFOKFO xx01 6538.5GB 512B/sect (Failed)

Re: REX for Multilined event + extract where line where match is found

gcusello — Tue, 29 Sep 2020 10:52:18 GMT

try this

\n*(?.Failed))\n

you can test it on https://regex101.com/
Bye.
Giuseppe

Re: REX for Multilined event + extract where line where match is found

arrowecssupport — Fri, 02 Sep 2016 11:18:11 GMT

If i run it under field extractor it doesn't show anything up.

Re: REX for Multilined event + extract where line where match is found

sundareshr — Fri, 02 Sep 2016 11:57:02 GMT

Try this

(?m)[\n]+(?<failed_disk_error>.*\(Failed\))

Re: REX for Multilined event + extract where line where match is found

gcusello — Fri, 02 Sep 2016 12:28:33 GMT

sorry but there was a mistake copying the regex:

\n*(?<myfield>.*Failed\))\n*

Bye.
Giuseppe

Re: REX for Multilined event + extract where line where match is found

arrowecssupport — Fri, 02 Sep 2016 16:09:34 GMT

Getting the issue where we get all lines up to the match.
So not just getting the 1 line i want but loads more.

Re: REX for Multilined event + extract where line where match is found

gcusello — Sun, 04 Sep 2016 07:05:03 GMT

To have more than one line you have to add /g at the end of the regex.
You can try it on https://regex101.com/
Bye.
Giuseppe

Re: REX for Multilined event + extract where line where match is found

inventsekar — Tue, 06 Sep 2016 15:40:33 GMT

not related to this question, but, something strange related to "answers.splunk.com"...
this post was created only 4 days back, but it says 2k views for this post.
the similar posts created on the same day are having only 70 or 80 or 100 views !!!

Re: REX for Multilined event + extract where line where match is found

gcusello — Fri, 09 Sep 2016 11:15:00 GMT

if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe

Re: REX for Multilined event + extract where line where match is found

arrowecssupport — Tue, 13 Sep 2016 15:42:44 GMT

(?-s)(?^.(Failed).$)

This was the final REX that gave me exactly what i wanted.

Re: REX for Multilined event + extract where line where match is found

arrowecssupport — Tue, 13 Sep 2016 15:43:23 GMT

Sorry it didn't resolve my issue. Thank you for you time on this.