topic regx in Splunk Search

regx

Siddharthnegi — Mon, 02 Sep 2024 10:04:18 GMT

Hi , I want to extract this line from an event.
RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy;

Re: regx

gcusello — Mon, 02 Sep 2024 10:06:32 GMT

Hi @Siddharthnegi ,

could you share some sample of your full message, highlighting in bold the part to extract?

Ciao.

Giuseppe

Re: regx

Siddharthnegi — Mon, 02 Sep 2024 10:08:11 GMT

I want to extract whole line till proxy
RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy;

Re: regx

ITWhisperer — Mon, 02 Sep 2024 10:10:18 GMT

Try something like this

| rex "^(?<line>.*proxy)"

Re: regx

Siddharthnegi — Mon, 02 Sep 2024 10:33:46 GMT

what if I want to remove RAISE-ALARM from staring

Re: regx

ITWhisperer — Mon, 02 Sep 2024 12:48:08 GMT

| rex "^RAISE-ALARM(?<line>.*proxy)"