Splunk Search

How do you make a regex expression to capture everything after the timestamp?

MikaJustasACN
Path Finder

Hello,

Cannot crack this one. I have the following event:

Fri Oct 26 07:19:41 2018
STATS: GATHER_STATS_JOB encountered errors. Check the trace file.
Errors in file G:\lumpy\bumpy\ykt\ttee\hee\trace.trc:

Code: timeout occurred

This an example event, and it does not have the exact character matches or exact number of lines, so basically I need to pick everything after the year \d{4}. Even If I set to ignore the line new line, it always extracts only the first line after the timestamp, but never all the lines. In regex101 it works fine.

rex I am using: | rex field=_raw "\n(?(.|\n)*)"

Tags (2)
0 Karma
1 Solution

MikaJustasACN
Path Finder

The following rex did the trick. it was not new line \n but some other stuff (one or several of [\r\n\t\f\v ] )

\d{2}\s\d{2}:\d{2}:\d{2}\s\d{4}\s(?(.+|\s)*)

If anyone sees how this can be improved, would be great 🙂

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@MikaJustasACN ,

Try this in splunk,

rex field=_raw "\d{4}(?<MY_FIELD>(.|\s)*)"

Extract everything after the "year" field

MikaJustasACN
Path Finder

The following rex did the trick. it was not new line \n but some other stuff (one or several of [\r\n\t\f\v ] )

\d{2}\s\d{2}:\d{2}:\d{2}\s\d{4}\s(?(.+|\s)*)

If anyone sees how this can be improved, would be great 🙂

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!