Splunk Search

Help with Rex or RegEx - Need Everything After a String

aferone
Builder

Here is an example of a VPN log with an error. I want to create a field for "Reason", which includes everything found after "Reason:", until the end of the line:

2014-02-26 11:26:05 -05:00 @vpn1 id=firewall time="2014-02-26 11:26:05" pri=6 fw=X.X.X.X vpn=vpn1 user=XXX realm="XXXX" roles="XXXXX" proto=auth src=X.X.X.X dst= dstname= type=vpn op= arg="" result= sent= rcvd= agent="" duration= msg="AUT22925: Host Checker policy 'Comp Configuration Check' failed on host X.X.X.X  for user 'XXX'. Reason: 'Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\XXX\not found; Registry key: HKEY_LOCAL_MACHINE\XXX\Plan not found; Registry key: HKEY_LOCAL_MACHINE\Wow6432Node\XXX\Plan not found; Registry key: HKEY_LOCAL_MACHINE\XXX\Plan  not found; Registry key: HKEY_LOCAL_MACHINE\Wow6432Node\XXX\Plan not found; Registry key: HKEY_LOCAL_MACHINE\XXX\Plan not found'."

Thanks!

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

your base search | rex "Reason:(?<Reason>.*)"

View solution in original post

somesoni2
Revered Legend

Try this

your base search | rex "Reason:(?<Reason>.*)"

aferone
Builder

Nailed it! Thank you!

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...