Splunk regex ignore fields before match

leandromatperei · ‎12-02-2021

I need to extract the contents of the message field, but the first strings must be ignored, I need to get from the stdout field.
Any ideas how to do this?

Examples:

message: 2021-12-02T20:06:11.541111542Z stdout F 2021-12-02 17:06:11,540 Completed 200 OK

message: 2021-12-02T20:06:11.540863953Z stdout F     contract: txt (truncated)...]

message: 2021-12-02T20:06:11.540857713Z stdout F     clientDocument: txt

ITWhisperer · ‎12-02-2021

| rex "message:.+stdout (?<stdout>.+)"

Splunk regex ignore fields before match

using Splunk Enterprise

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Join the Conversation

Splunk regex ignore fields before match

using Splunk Enterprise

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...