Splunk Search

How do you make a regex expression to capture everything after the timestamp?

MikaJustasACN
Path Finder

Hello,

Cannot crack this one. I have the following event:

Fri Oct 26 07:19:41 2018
STATS: GATHER_STATS_JOB encountered errors. Check the trace file.
Errors in file G:\lumpy\bumpy\ykt\ttee\hee\trace.trc:

Code: timeout occurred

This an example event, and it does not have the exact character matches or exact number of lines, so basically I need to pick everything after the year \d{4}. Even If I set to ignore the line new line, it always extracts only the first line after the timestamp, but never all the lines. In regex101 it works fine.

rex I am using: | rex field=_raw "\n(?(.|\n)*)"

Tags (2)
0 Karma
1 Solution

MikaJustasACN
Path Finder

The following rex did the trick. it was not new line \n but some other stuff (one or several of [\r\n\t\f\v ] )

\d{2}\s\d{2}:\d{2}:\d{2}\s\d{4}\s(?(.+|\s)*)

If anyone sees how this can be improved, would be great 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@MikaJustasACN ,

Try this in splunk,

rex field=_raw "\d{4}(?<MY_FIELD>(.|\s)*)"

Extract everything after the "year" field

---
What goes around comes around. If it helps, hit it with Karma 🙂

MikaJustasACN
Path Finder

The following rex did the trick. it was not new line \n but some other stuff (one or several of [\r\n\t\f\v ] )

\d{2}\s\d{2}:\d{2}:\d{2}\s\d{4}\s(?(.+|\s)*)

If anyone sees how this can be improved, would be great 🙂

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...