regular expression

Siddharthnegi · ‎09-24-2024

Hi i want to extract highlighted part

Sep 24 10:43:25 10.82.10.245 [S=217] [BID=d57afa:30] RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy; Severity:major; Source:Board#1/ProxyConnection#1; Unique ID:242; Additional Info1:; [Time:24-09@17:43:25.248] [63380759]

richgalloway · ‎09-24-2024

Per regex101.com, this expression works with the sample event.

Time:(?<time>[^\]]+)

---
If this reply helps you, Karma would be appreciated.

isoutamo · ‎09-28-2024

regex101.com is your friend https://regex101.com/r/rB5kWs/1

regular expression

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Enriching Signals with the OTel Lookup Processor

Meet the .conf26 AI Agent Buildathon Winners

Join the Conversation

regular expression

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Enriching Signals with the OTel Lookup Processor

Meet the .conf26 AI Agent Buildathon Winners