I want to extract part of an event that is multi-line and tab formated, the event lokks like this:
11:19:29.000 PM
7.05 0.00 (1343189969 083501): Query a ejecutar: SELECT prop_account, description
FROM tracking.google_analytics_web_properties
WHERE prop_type = 'qa'
AND home = 'es_cl'
AND portal = '*'
I want to extract from Query I use a regex and I have a variable called Message. But when I displayed it Splunk truncate the message.
1 Query a ejecutar: SELECT prop_account, description
I am using this search command:
sourcetype="xtype" query | rex field=_raw "):\s(?
Any idea could be great.
Professional services recommend me to do the following:
sourcetype="xtype" query | eval long_str=replace(_raw, "\n", "###") | rex field=long_str "):\s(?
The second part of the search replaces the new lines for a know pattern (on this case ###).
Then you use REGEX to capture the field from the long_str
Using makemv you break the lines when it found the pattern "###"
Lastly you present the data into a table, this is the result.
Query a ejecutar: SELECT prop_account, description FROM tracking.google_analytics_web_properties
WHERE prop_type = 'qa' AND
home = 'es_cl' AND portal = '*'
Try
sourcetype="xtype" query | rex field=_raw "(?m)):s(?<message>.+)" | table Message
The (?m)
tells the regex to work across line breaks.
Thank you, that works to capture all data into the variable but it does not maintain the line breaking inside the Message Variable