I've been trying to create a regex to generate a field name without success. The data I'm attempting to parse looks like:
logsrv> Message server exiting.
I would like to make logsrv represent a subsystem so that my field is subsystem and logsrv is the data for that field.
So far I have the following expression that works on a regex tester: ^.*?(?=>)
but I'm missing something with Splunk since it won't return any results no matter I try. The field extractor doesn't have any luck either when I try to create the expression using logsrv from the results.
Please help.
Have you tried testing this out with the rex command in Splunk with the search language?
|rex field=_raw "^(?<subsystem>[^>]+)>"
I am not sure if that will work if your raw event has anything before the "logsrv>" in the event line such as a timestamp.
Thank you! You're right. The data has the timestamp on the previous line and splunk returns results with the time and logsrv combined.
Data:
27-Jun-13 19:34:37
logsrv> Message server exiting.
Result:
27-Jun-13 19:34:37 logsrv
Do I need to search for a preceding carriage return or pattern match the time?
Thanks again!