topic Regex to ignore [\r][\n] in Splunk Search

Regex to ignore [\r][\n]

saad_siddiqi — Wed, 10 Jul 2013 00:33:35 GMT

Hi there,

I have been trying to remove the below line which is a big part of one of the logs. Been trying with many regex types in transforms.conf but it doesn't recognize it when I a put in "[\r][\n]".

DEBUG - wire << "[\r][\n]"

I have tried many options like
"[\\r][\\n]"
"[\\r][\\n]\"
etc but still no luck.

Can anyone help me out with this.

Thanks

Re: Regex to ignore [\r][\n]

sbrant_splunk — Wed, 10 Jul 2013 01:47:08 GMT

try \[\\r\]\[\\n\]

You must escape not only the backslashes but also the square brackets.

Re: Regex to ignore [\r][\n]

sbrant_splunk — Wed, 10 Jul 2013 01:56:55 GMT

BTW, this will match [\r][\n] but you mention "ignoring" the pattern. Do you mean that you've collected the data and you want to ignore those lines in your search results or do you mean that you'd like to not index the lines that contain that pattern?

Re: Regex to ignore [\r][\n]

saad_siddiqi — Wed, 10 Jul 2013 02:12:31 GMT

That did the trick... Cheers mate!

Re: Regex to ignore [\r][\n]

saad_siddiqi — Wed, 10 Jul 2013 02:13:55 GMT

Yeah, I wanted not to index the lines DEBUG - wire << "[\r][\n]"