topic RegEx Pattern for Event Break in SourceType in Splunk Search

RegEx Pattern for Event Break in SourceType

neiowe — Wed, 30 Nov 2016 20:43:22 GMT

Hi all,

I am trying to determine the RegEx pattern for the Event Break. Below is an example event. A new event starts on the line preceding the "Information Message: Processing file:" text. The process number and the timestamp varies on the first line as does the info that follows "Information Message: Processing file:" until the next event starts.

1050746893 2016-11-25 05:36:02,518 [7] DEBUG DealerTrackImageDecoder, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -
Information Message: Processing file: C:\dealertrack\contracts\0C075017-0-1899123053557contract.xml

Thanks in advance for any help,

Neil

Re: RegEx Pattern for Event Break in SourceType

gokadroid — Thu, 01 Dec 2016 04:21:30 GMT

Can you check if this regex works for event breaker:

^\d{10}\s

Re: RegEx Pattern for Event Break in SourceType

neiowe — Thu, 01 Dec 2016 14:02:14 GMT

Thanks. I wish it was that easy. That 10 digit number is the process number and is included on each process entry. However, there are most time multiple processes that make up what I am wanting to be a single event. The text "Information Message: Processing file:" on the second line is what indicates that a new file is being processed. I want to include all processes below that until the next "Information Message: Processing file:" into a single event.

I can use "Information Message: Processing file:" as the pattern and that gets me close, but I need the line right before "Information Message: Processing file:" to be included in the event also.