Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How to write regex to create new events before...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to write regex to create new events before a certain time format?
Hi,
Please some help me to create new event if i find HH:MM:SS time format in logs for sourcetype perfLog.
I have used below configuration in props.conf file inside Indexer /opt/splunk/etc/system/local dir.
[sourcetype::perfLog]
SHOULD_LINEMERGE=false
BREAK_ONLY_BEFORE=^(?:\d|[01]\d|2[0-3]):[0-5]\d$
But still it did not work. Below are the example of logs.
08:11:13 |INFO | | LoggingHandler | ausu512a.wm.com|{http://esb.wm.com/service/getCustAccountInfo}getCustAccountInfo|getCustAccountInfo|329179|START TIME|Tue Aug 26 08:11:13 CDT 2014|Elapsed Time MS|244| MS |ESB CALL|TRANSACTION ID|2934447739687911190|
08:11:13 |DEBUG | | Profiler | ausu512a.wm.com|class com.wm.css.payment.dao.impl.PayTransactionDaoImpl|List com.wm.css.payment.dao.PayTransactionDao.getPaymentDetailsForAccount(String)|329179|START TIME|Tue Aug 26 08:11:13 CDT 2014|Elapsed Time MS|26| MS |
08:11:13 |DEBUG | | Profiler | ausu512a.wm.com|class com.wm.css.payment.service.impl.PaymentServiceImpl|List com.wm.css.payment.service.PaymentService.getPaymentDetailsForAccount(String)|329179|START TIME|Tue Aug 26 08:11:13 CDT 2014|Elapsed Time MS|26| MS |
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
BREAK_ONLY_BEFORE=^\d{2}:\d{2}:\d{2}\s\|
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My advice would be to use www.regexr.com or similar to find a correct one 🙂 Otherwise I'd just help you this once and you wouldn't learn anything.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try changing the BREAK_ONLY_BEFORE statement to 'LINE_BREAKER=([\r\n]+)(\d\d:\d\d:\d\d)'.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes. I did
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you restart Splunk?
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks but its not working.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Help to create regex for same please ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Your regex isn't matching, so...
You're looking for ^(?:\d|[01]\d|2[0-3]):[0-5]\d$ and I don't see that matching anything in your sample events.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster
What's New in Splunk Enterprise Security 8.8 and Beyond
A Four-Part Event Series: State of Observability - Where AI Meets Performance
