Splunk Search

How do you make a regex expression to capture everything after the timestamp?

MikaJustasACN
Path Finder

Hello,

Cannot crack this one. I have the following event:

Fri Oct 26 07:19:41 2018
STATS: GATHER_STATS_JOB encountered errors. Check the trace file.
Errors in file G:\lumpy\bumpy\ykt\ttee\hee\trace.trc:

Code: timeout occurred

This an example event, and it does not have the exact character matches or exact number of lines, so basically I need to pick everything after the year \d{4}. Even If I set to ignore the line new line, it always extracts only the first line after the timestamp, but never all the lines. In regex101 it works fine.

rex I am using: | rex field=_raw "\n(?(.|\n)*)"

Tags (2)
0 Karma
1 Solution

MikaJustasACN
Path Finder

The following rex did the trick. it was not new line \n but some other stuff (one or several of [\r\n\t\f\v ] )

\d{2}\s\d{2}:\d{2}:\d{2}\s\d{4}\s(?(.+|\s)*)

If anyone sees how this can be improved, would be great 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@MikaJustasACN ,

Try this in splunk,

rex field=_raw "\d{4}(?<MY_FIELD>(.|\s)*)"

Extract everything after the "year" field

---
What goes around comes around. If it helps, hit it with Karma 🙂

MikaJustasACN
Path Finder

The following rex did the trick. it was not new line \n but some other stuff (one or several of [\r\n\t\f\v ] )

\d{2}\s\d{2}:\d{2}:\d{2}\s\d{4}\s(?(.+|\s)*)

If anyone sees how this can be improved, would be great 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...