topic Re: how to write Regex expression in Splunk Search https://community.splunk.com/t5/Splunk-Search/how-to-write-Regex-expression/m-p/85787#M21903 <P>really ur maverick...its worked....</P> Fri, 05 Jul 2013 11:49:36 GMT Paul_tcs 2013-07-05T11:49:36Z how to write Regex expression https://community.splunk.com/t5/Splunk-Search/how-to-write-Regex-expression/m-p/85782#M21898 <P>Hi xperts,</P> <P>Am new to splunk. I am uploading my data into the splunk. when i see the preview, it shows me all the events in the only line. i have the date 10:22:58 04/16/2013 as seprater. i want to break the line for new event after this type of time stamp. when i go through the kbs and articles, i found the term as regex..kindly help me how to write the regex with examples.</P> Fri, 05 Jul 2013 11:29:23 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-Regex-expression/m-p/85782#M21898 Paul_tcs 2013-07-05T11:29:23Z Re: how to write Regex expression https://community.splunk.com/t5/Splunk-Search/how-to-write-Regex-expression/m-p/85783#M21899 <P>Add a sample of data to make easier help you</P> Fri, 05 Jul 2013 11:30:22 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-Regex-expression/m-p/85783#M21899 gfuente 2013-07-05T11:30:22Z Re: how to write Regex expression https://community.splunk.com/t5/Splunk-Search/how-to-write-Regex-expression/m-p/85784#M21900 <P>10:22:58 04/16/2013 alert<BR /> alert-type: SNMPTrap<BR /> alert-name: Unix_CPU_Composite_Normal<BR /> alert-failed: true<BR /> alert-message: SiteScope/dbnk04p4/CPU &amp; CPU Load/1/no items checked/10:22 AM 4/16/13<BR /> alert-monitor: CPU &amp; CPU Load</P> <P>10:22:59 04/16/2013 alert<BR /> alert-type: SNMPTrap<BR /> alert-name: Memory_Normal<BR /> alert-failed: true<BR /> alert-message: SiteScope/dbnk04p4/Memory/1/2% swap space used, 80280MB swap space free; 97% physical memory used, 882MB physical memory free/10:22 AM 4/16/13<BR /> alert-monitor: Memory</P> Mon, 28 Sep 2020 14:16:07 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-Regex-expression/m-p/85784#M21900 Paul_tcs 2020-09-28T14:16:07Z Re: how to write Regex expression https://community.splunk.com/t5/Splunk-Search/how-to-write-Regex-expression/m-p/85785#M21901 <P>Here you go:</P> <PRE><CODE>\d{2}:\d{2}:\d{2}\s\d{2}/\d{2}/\d{4} </CODE></PRE> <P>Regards</P> Fri, 05 Jul 2013 11:44:14 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-Regex-expression/m-p/85785#M21901 gfuente 2013-07-05T11:44:14Z Re: how to write Regex expression https://community.splunk.com/t5/Splunk-Search/how-to-write-Regex-expression/m-p/85786#M21902 <P>can uhelp me how to write this regex..</P> Fri, 05 Jul 2013 11:47:53 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-Regex-expression/m-p/85786#M21902 Paul_tcs 2013-07-05T11:47:53Z Re: how to write Regex expression https://community.splunk.com/t5/Splunk-Search/how-to-write-Regex-expression/m-p/85787#M21903 <P>really ur maverick...its worked....</P> Fri, 05 Jul 2013 11:49:36 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-Regex-expression/m-p/85787#M21903 Paul_tcs 2013-07-05T11:49:36Z