topic Re: How to edit my regular expression to grab the first line in a log? in Splunk Search

How to edit my regular expression to grab the first line in a log?

sankarms — Wed, 07 Dec 2016 03:09:13 GMT

I have a log file like this:

Type: something/something; something
The next line

I want to write a Splunk search to grab the first line and create a pie chart of the various different types. The problem is the query I wrote is taking in The next line bit too which I don't want. Here's my query:

("Type: " OR "type: ") | rex field=_raw "(?<type>.*)\n" | stats count by type

How do I write a search that takes everything after the : but stops at the newline \n?

Re: How to edit my regular expression to grab the first line in a log?

mrgibbon — Wed, 07 Dec 2016 03:11:59 GMT

This should do it:

rex "somestring :(?P<type>[^\n]+)"

Re: How to edit my regular expression to grab the first line in a log?

gokadroid — Wed, 07 Dec 2016 03:20:57 GMT

Try this please:

your query to return events
|  rex "Type:\s*(?<myType>[^\n\r]+)"
| stats count by myType

Use visualization as Pie Chart

See extraction here

Re: How to edit my regular expression to grab the first line in a log?

sankarms — Wed, 07 Dec 2016 03:33:58 GMT

So would my search be:

("Type: " OR "type: ") | rex field=_raw "(?P[^\n]+)" | stats count by type

Re: How to edit my regular expression to grab the first line in a log?

niketn — Wed, 07 Dec 2016 07:32:25 GMT

As per regular expression standards, dot matches any single character except newline character provided regex is run with multiline (?m) regex flag. Following should work for you. You also need to specify match pattern to identify beginning of regular expression extraction i.e. Type:

| rex field=_raw "(?m)Type:\s(?<type>.*)"

PS: By default the regex flag is single line(?s), then dot matches newline character as well, hence you are seeing all the text selected, event from the second line.

Also once you have tested the rex command, make sure you move this from your search query to Knowledge object as a Field Extraction, for easy maintenance.