topic Regex for pattern match in Splunk Search

Regex for pattern match

RashmiGowda — Fri, 21 Mar 2014 08:11:39 GMT

Hello

I need a regex expression to match the below patern in my abc.log

Pattern details:

, 2014-03-20 13:43:55.608, 2014-03-20 13:43:55.612,

-- Contains sring values.

Please suggest the regex for this..??

Thanks in advance..!!

Re: Regex for pattern match

MuS — Fri, 21 Mar 2014 08:15:45 GMT

Hi RashmiGowda,

based on this one line example try something like this:

... | rex ">,\s(?<stringfield>.+),\s<" | ...

cheers, MuS

Re: Regex for pattern match

RashmiGowda — Fri, 21 Mar 2014 09:46:11 GMT

Its not working.. 😞

Re: Regex for pattern match

kristian_kolb — Fri, 21 Mar 2014 10:40:24 GMT

RashmiGowda,

You might have to provide a little more information; in which context are you trying to use the regex (search, field extraction, what config files etc), and also; how is it not working.

Re: Regex for pattern match

tsmets — Thu, 07 Apr 2016 13:05:50 GMT

I downvoted this post because question is unclear

Re: Regex for pattern match

ddrillic — Thu, 07 Apr 2016 14:44:52 GMT

You can work on it like this -

your base search 
| eval basavalue="2014-03-20 13:43:55.608"
| rex field=basavalue "(?<a_1>\d\d\d\d)-(?<a_2>\d\d)"