All Apps and Add-ons

Regex for Field Extraction

robhorton
Explorer

I've been trying to create a regex to generate a field name without success. The data I'm attempting to parse looks like:

logsrv> Message server exiting.

I would like to make logsrv represent a subsystem so that my field is subsystem and logsrv is the data for that field.

So far I have the following expression that works on a regex tester: ^.*?(?=>)
but I'm missing something with Splunk since it won't return any results no matter I try. The field extractor doesn't have any luck either when I try to create the expression using logsrv from the results.

Please help.

0 Karma

Rob
Splunk Employee
Splunk Employee

Have you tried testing this out with the rex command in Splunk with the search language?

|rex field=_raw "^(?<subsystem>[^>]+)>"

I am not sure if that will work if your raw event has anything before the "logsrv>" in the event line such as a timestamp.

robhorton
Explorer

Thank you! You're right. The data has the timestamp on the previous line and splunk returns results with the time and logsrv combined.

Data:
27-Jun-13 19:34:37
logsrv> Message server exiting.

Result:
27-Jun-13 19:34:37 logsrv

Do I need to search for a preceding carriage return or pattern match the time?

Thanks again!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...