Splunk regex ignore fields before match

leandromatperei · ‎12-02-2021

I need to extract the contents of the message field, but the first strings must be ignored, I need to get from the stdout field.
Any ideas how to do this?

Examples:

message: 2021-12-02T20:06:11.541111542Z stdout F 2021-12-02 17:06:11,540 Completed 200 OK

message: 2021-12-02T20:06:11.540863953Z stdout F     contract: txt (truncated)...]

message: 2021-12-02T20:06:11.540857713Z stdout F     clientDocument: txt

ITWhisperer · ‎12-02-2021

| rex "message:.+stdout (?<stdout>.+)"

Splunk regex ignore fields before match

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Free Professional Services for .conf26 Attendees

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

Join the Conversation

Splunk regex ignore fields before match

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Free Professional Services for .conf26 Attendees

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26