Getting Data In
Highlighted

Regex parse message to multiple lines help

Engager

I have a below message: 
[32minfo: [Clean Storage] brand/market/testing1.html, brand/market/testing2.html, brand/market/testing3.html were successfully deleted from container stores-test

How do I use the splunk query to show the message as below:
brand market testing1.html
brand market testing2.html
brand market testing3.html

i've spent hours trying and I just could not got it right.

Thanks for your help.

0 Karma
Highlighted

Re: Regex parse message to multiple lines help

Champion

Please use Code Sample or Ctrl + K to post your sample message.

0 Karma
Highlighted

Re: Regex parse message to multiple lines help

Influencer

Use rex command with max_match=0. Try this.

| makeresults 
| eval _raw="[32minfo: [Clean Storage] brand/market/testing1.html, brand/market/testing2.html, brand/market/testing3.html were successfully deleted from container stores-test" 
| rex max_match=0 "(?<message>[\w\/]+.html)" 
| mvexpand message 
| eval message=replace(message, "/", " ") 
| table message
Highlighted

Re: Regex parse message to multiple lines help

Hi @kevincai79

try this --

|makeresults |eval hari="[32minfo: [Clean Storage] brand/market/testing1.html, brand/market/testing2.html, brand/market/testing3.html were successfully deleted from container stores-test" |table hari |rex field=hari "\] (?<Newfield>.*) were" |eval hari=trim(split(Newfield,",")) |rex field=hari mode=sed "s/\// /g" |table hari
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.