Splunk Search

How do you use regex to parse the following text?

New Member

Hi,

I have the following text to parse. I want to break when I encounter the **** date ***. I tried the following, but I am not able to parse it correctly. Could you please help?

BREAKONLYBEFORE=(\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2})
MAXTIMESTAMPLOOKAHEAD=30
SHOULDLINEMERGE=true
TRUNCATE=10
disabled=false
TIME
FORMAT=(%b %d %H:%M:%S)
TIME_PREFIX=^.*

*************
Feb 07 06:10:34 : STEP 4
*************

+ [ ]
+ send_emails
+ send_success_email
+ print '\n**********\nMon Jan 14 08:01:10 GMT 2019 : job 
+ List item
0\n**********\n'

*************
Feb 08 06:10:34 : job 
*************

+ [[ -e /junk.chk ]]
+ [[ 0 -eq 0 ]]
+ rm -f /junk.chk
+ exec
+ 1>& 3 2>& 3
+ print '\n**********\nMon Jan 14 09:01:10 GMT 2019 : job 
+ List item
0\n**********\n'
Tags (2)
0 Karma
1 Solution

Esteemed Legend

Try this (and ONLY this):

LINE_BREAKER=([\r\n\s]+\*+[\r\n\s]+)
SHOULD_LINEMERGE=false
TIME_PREFIX=^
TIME_FORMAT=%b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD=15

View solution in original post

0 Karma

Esteemed Legend

Try this (and ONLY this):

LINE_BREAKER=([\r\n\s]+\*+[\r\n\s]+)
SHOULD_LINEMERGE=false
TIME_PREFIX=^
TIME_FORMAT=%b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD=15

View solution in original post

0 Karma

New Member

thank you @woodcock

0 Karma

Communicator

I tried to ingest your data.
When i removed your Truncate=10 option and added the "\s:" to BREAKONLYBEFORE i get 3 events.

BREAKONLYBEFORE=(\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2}\s:)

Maybe it helps for you?

0 Karma