RegEx data after curly brackets

CPrimoR · ‎11-22-2024

I'm trying to regex the field that has "REPLY"
CommonEndpointLoggingAspect {requestId=94f2a697-3c0d-4835-b96a-42be3d2426e2, serviceName=getCart} - REPLY

richgalloway · ‎11-22-2024

What have you tried so far? Was it anything like this?

| rex "\}\s*-\s*(?<field>.*)"

---
If this reply helps you, Karma would be appreciated.

RegEx data after curly brackets

data

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Enriching Signals with the OTel Lookup Processor

Meet the .conf26 AI Agent Buildathon Winners

Painting a Clearer Picture: Unifying Your Investigations with Cisco AI Canvas

Join the Conversation

RegEx data after curly brackets

data

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Enriching Signals with the OTel Lookup Processor

Meet the .conf26 AI Agent Buildathon Winners

Painting a Clearer Picture: Unifying Your Investigations with Cisco AI Canvas