How do you extract out relevant message from _raw, trimming the timestamp part?

[jainkul123]

How can I trim the date timestamp from _raw. My _raw is as follows:

[1/13/19 10:18:20:577 GMT] 00000097 LogOut O INFO: Sun Jan 13 10:18:20 GMT 2019: **THIS IS MY MESSAGE STRING.* *

And I want to extract out just the message: THIS IS MY MESSAGE STRING.

[tiagopeq]

This was the most generic regex I could find with the amount of information you shared, while staying minimally efficient I'd say:

| makeresults count=1
| eval _raw="[1/13/19 10:18:20:577 GMT] 00000097 LogOut O INFO: Sun Jan 13 10:18:20 GMT 2019: THIS IS MY MESSAGE STRING."
| rex "\[\d*\/\d*\/\d* \d{2}:\d{2}:\d{2}:\d{3}[^\]]+\].*INFO:[^:]+:\d{2}:\d{2}[^:]+:(?<_raw>.*)"

[renjith_nair]

@jainkul123 ,

Give this a try,

"your search"|rex field=_raw "\w{3}\s\w{3}\s+\d{1,2}\s+\d{1,2}:\d{1,2}:\d{1,2}\s\w{3}\s\d{4}:\s(?<Message>.+)"

[jainkul123]

This works, thank you

[skoelpin]

If it works you should accept it to close out the question

[rshah_splunk]

You can try using the below regular expression.

  \[.*\].*?\w{3}\s+\w{3}\s+\d{1,2}\s+\d{2}\:\d{2}\:\d{2}\s\S+\s+\d{4}\:\s+(?.*)

Demo: https://regex101.com/r/ze1Jxk/1