topic Re: Regex to match everything after the last occurence of a character in Splunk Search

Regex to match everything after the last occurence of a character

bcatwork — Tue, 07 Jun 2016 19:43:20 GMT

I did not anticipate I'd struggle this much for what seemed like such a simple task.

The logs I am trying to parse have all sorts of crap sandwiched into [brackets].

Examples:

[thread] [timestamp] [transactionID] logLevel {moreNonsense}

[thread] [timestamp] logLevel [transactionID] {moreNonsense}

I want the logLevel. To say, I want all the text after the last occurrence of ], but before the first occurrence of }
Using regular expressions, how can I state to only return the string following that last ]. There is no consistency in the character length or type of each bracketed field, there is also a variable number of bracket sets in each event, prior to the logLevel (2, 3 or 4 sets, dependent on the log source).

Each attempt I have made has yielded a logLevel value of everything following the very first closed bracket ]

Re: Regex to match everything after the last occurence of a character

sundareshr — Tue, 07 Jun 2016 20:02:31 GMT

If log_level can be multiple words, use this

.*\]\s*(?<log_level>[^\{]+)

OR if it is always single word, use this

.*\]\s*(?<log_level>\w+)\s*\{

OR if log_level is a finite list, try this

(?<log_level>INFO|WARN|DEBUG|CRITICAL)

Re: Regex to match everything after the last occurence of a character

javiergn — Tue, 07 Jun 2016 20:04:56 GMT

What about this:

your base search
| rex "(\[[^\]]+\]\s?)+(?<logLevel>\w+)"

Example 1:

| stats count | fields - count
| eval _raw = "[thread] [timestamp] [transactionID] LOGLEVEL1 {moreNonsense}"
| rex "(\[[^\]]+\]\s?)+(?<logLevel>\w+)"

Output:

logLevel = LOGLEVEL1

Example 2:

| stats count | fields - count
| eval _raw = "[thread] [timestamp] LOGLEVEL2 [transactionID] {moreNonsense}"
| rex "(\[[^\]]+\]\s?)+(?<logLevel>\w+)"

Output:

logLevel = LOGLEVEL2