Dashboards & Visualizations

Help required on regex

rangarbus
Path Finder

Hello Friends,

I am looking for your help for a rex expression.

message =  [2021-05-26 00:00:33,477] {taskinstance.py:669} INFO - Dependencies all met for <TaskInstance: example_dag_oidc.test_bash 2021-05-25 00:00:00+00:00 [None]> 

I would like to split this message field as below fields:

  • logDateTime = 2021-05-26 00:00:33,477
  • logLevel = INFO
  • logMessage = Dependencies all met for <TaskInstance: example_dag_oidc.test_bash 2021-05-25 00:00:00+00:00 [None]> 

Thanks

Labels (1)
0 Karma
1 Solution

eddieddieddie
Path Finder

Try the following regex with the rex command:

 

"\[(?<logDateTime>[\d, :,-]+)\].+ (?<logLevel>\w+) - (?<logMessage>.+)"

 

In Splunk SPL it would look like this (assuming that the raw data is in a field called 'message'):

 

| rex field=message "\[(?<logDateTime>[\d, :,-]+)\].+ (?<logLevel>\w+) - (?<logMessage>.+)"
| table logDateTime logLevel logMessage

 

 

Hopefully that suits your needs?

Eddie

 

View solution in original post

0 Karma

eddieddieddie
Path Finder

Try the following regex with the rex command:

 

"\[(?<logDateTime>[\d, :,-]+)\].+ (?<logLevel>\w+) - (?<logMessage>.+)"

 

In Splunk SPL it would look like this (assuming that the raw data is in a field called 'message'):

 

| rex field=message "\[(?<logDateTime>[\d, :,-]+)\].+ (?<logLevel>\w+) - (?<logMessage>.+)"
| table logDateTime logLevel logMessage

 

 

Hopefully that suits your needs?

Eddie

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...