All Apps and Add-ons

rex everything after 8th whitespace

subtrakt
Contributor

2014-02-01T14:51:24.601752+00:00 .foo.com 21470: Feb 1 14:51:23.570 GMT: %SEC-6-IPACCESSLOGP:

I looked around but couldn't find a rex query to extract the actual Syslog message which would be after the 8th colon in the above message or 8th whitespace will also work.

rex generator isn't giving the desired results.

Thanks in advance for any help.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could prefix the expression with one that matches eight whitespaces:

^(\S*\s){8}(?<everything_after>.*)$

View solution in original post

mikaelbje
Motivator

This field has already been extracted and is called "message_text". If you want to do some magic on the contents of it, just reference that field from the rex command instead of _raw.

I wouldn't recommend you to do a rex after the 8th colon as there is no guarantee there will be eight colons in a IOS syslog message. It all depends on how the logging from the device is set up.

Regards,

Mikael

Author of the Cisco IOS app

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could prefix the expression with one that matches eight whitespaces:

^(\S*\s){8}(?<everything_after>.*)$

martin_mueller
SplunkTrust
SplunkTrust

That works the same way, just replace \S with [^:] and \s with :

0 Karma

subtrakt
Contributor

What about after 8th ':'

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Right - I had one closing parenthesis too many after {8}... adding one in front works as well of course.

For learning and testing, take a look at http://www.regexr.com/

0 Karma

subtrakt
Contributor

rex ^((\S*\s){8})(?.*)$ --- Added another '(' after '^' and it works like a dream! Thanks! Do you recommend any regex cheatsheets or learning resources?

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...