Capturing logs using regex

[nikhilagrawal]

Hi,I've below log lines in below
format:

1) D:\SystemX\XManager\TEST1_XM_5_1_0_361\Director\GenericService.log

2) D:\SystemX\XTrader\TEST1_XM_5_1_0_361\Director\GenericService.log

3) D:\SystemX\XInterface\TEST1_XM_5_1_0_361\Director\GenericService.log

How can I get the logs under D:\SystemX\...... I have created field extract filter to seperate XManager, XTrader and Xinterface and I want to view logs in a way that if I select XManager I will see all logs under D:\SystemX\XManager\.. and so on.
The regex i was trying : ^\w+\:\\SystemX\\(?<app>[A-Za-z]*)
But it showing error.

I really appreciate your help.
Thanks

[Lamar]

Nik,

I'm curious why you're not just sourcetyping these...ie:

In props.conf.

[source::.../XManager/.../GenericService.log]
sourcetype = XManager

[source::.../XTrader/.../GenericService.log]
sourcetype = XTrader

[source::.../XInterface/.../GenericService.log]
sourcetype = XInterface

That way, when you search on them you just type:

sourcetype = XManager <rest of your search>

You will get all of the files (regardless of which version they are) that have XManager in the directory structure and end with the filename of GenericService.log.

Hope that helps.

[Lowell]

Try switching from slashes to backslashes. Remember the backslashes need to be escaped, i.e. \\. (Or, setup a rule that allow for both unix and windows separators using something like this: [source::...[/\\]XInterface[/\\]...[/\\]GenericService.log]. It looks funny, but it should work.

[nikhilagrawal]

Thanks for suggestion. I should have think this before. I tried the above changes in prop.conf but its not working.
1) I am looking log files from windows machine so I changed the forward slash to backward.

[source::...\XManager\...\GenericService.log]
sourcetype=XManager

Exact location:
D:\SystemX\XManager\TEST1_XM_5_1_0_366\Director\GenericService\Logs\SystemX\GenericService.log

I just have to make the changes under deployment server not on the indexer right?

Please let me correct if I am wrong.
thanks, Nik