Getting Data In

Regex parse message to multiple lines help

kevincai79
Engager

I have a below message: 
[32minfo: [Clean Storage] brand/market/testing1.html, brand/market/testing2.html, brand/market/testing3.html were successfully deleted from container stores-test

How do I use the splunk query to show the message as below:
brand market testing1.html
brand market testing2.html
brand market testing3.html

i've spent hours trying and I just could not got it right.

Thanks for your help.

0 Karma

harishalipaka
Motivator

Hi @kevincai79

try this --

|makeresults |eval hari="[32minfo: [Clean Storage] brand/market/testing1.html, brand/market/testing2.html, brand/market/testing3.html were successfully deleted from container stores-test" |table hari |rex field=hari "\] (?<Newfield>.*) were" |eval hari=trim(split(Newfield,",")) |rex field=hari mode=sed "s/\// /g" |table hari
Thanks
Harish

manjunathmeti
Champion

Use rex command with max_match=0. Try this.

| makeresults 
| eval _raw="[32minfo: [Clean Storage] brand/market/testing1.html, brand/market/testing2.html, brand/market/testing3.html were successfully deleted from container stores-test" 
| rex max_match=0 "(?<message>[\w\/]+.html)" 
| mvexpand message 
| eval message=replace(message, "/", " ") 
| table message

vnravikumar
Champion

Please use Code Sample or Ctrl + K to post your sample message.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Introducing .conf Stories Series!

“.conf Stories” Series – First Feature: Rich Mahlerwein   Every year .conf brings together some of the most ...