Dashboards & Visualizations

Help required on regex

rangarbus
Path Finder

Hello Friends,

I am looking for your help for a rex expression.

message =  [2021-05-26 00:00:33,477] {taskinstance.py:669} INFO - Dependencies all met for <TaskInstance: example_dag_oidc.test_bash 2021-05-25 00:00:00+00:00 [None]> 

I would like to split this message field as below fields:

  • logDateTime = 2021-05-26 00:00:33,477
  • logLevel = INFO
  • logMessage = Dependencies all met for <TaskInstance: example_dag_oidc.test_bash 2021-05-25 00:00:00+00:00 [None]> 

Thanks

Labels (1)
0 Karma
1 Solution

eddieddieddie
Path Finder

Try the following regex with the rex command:

 

"\[(?<logDateTime>[\d, :,-]+)\].+ (?<logLevel>\w+) - (?<logMessage>.+)"

 

In Splunk SPL it would look like this (assuming that the raw data is in a field called 'message'):

 

| rex field=message "\[(?<logDateTime>[\d, :,-]+)\].+ (?<logLevel>\w+) - (?<logMessage>.+)"
| table logDateTime logLevel logMessage

 

 

Hopefully that suits your needs?

Eddie

 

View solution in original post

0 Karma

eddieddieddie
Path Finder

Try the following regex with the rex command:

 

"\[(?<logDateTime>[\d, :,-]+)\].+ (?<logLevel>\w+) - (?<logMessage>.+)"

 

In Splunk SPL it would look like this (assuming that the raw data is in a field called 'message'):

 

| rex field=message "\[(?<logDateTime>[\d, :,-]+)\].+ (?<logLevel>\w+) - (?<logMessage>.+)"
| table logDateTime logLevel logMessage

 

 

Hopefully that suits your needs?

Eddie

 

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>