Splunk Search

How to catch end of line symbols with regex?

avasilievnko
Explorer

I have symbols that mean end of line

\r\n

Example of string:

D:\INSTALL\_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

My regex looks like this

([a-zA-Z]:)(\\.*\\r\\n)

PS. log looks like this:

blablabla\r\n D:\INSTALL\_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

I need catch only line like this

D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n
Tags (2)
0 Karma
1 Solution

avasilievnko
Explorer

I win it with adding ? , it makes it non-greedy. regex: (?([a-zA-Z]:)(\.*?\r\n))

I can math only lines, like in the middle
blablabla\r\n D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

View solution in original post

0 Karma

avasilievnko
Explorer

I win it with adding ? , it makes it non-greedy. regex: (?([a-zA-Z]:)(\.*?\r\n))

I can math only lines, like in the middle
blablabla\r\n D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

0 Karma

javiergn
Super Champion

What about the following regex:

(\w\:[^\r\n]+)

Regards,
J

0 Karma

avasilievnko
Explorer

It's catch all log file, but i should rich and of the line in strings like this:
D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

(?([a-zA-Z]:)(\.*\r\n))

So that the following lines with \r\n are not caught

Need to stop regular expression at first match \r\n in line like this
D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

0 Karma

avasilievnko
Explorer

its's better , but it catch other lines with \r\n

Full log

Jun 5 14:39:40 blabla-pc.blabla.bla bla|10.3.0.0 Результат: Помещено на карантин: not-a-virus:HEUR:AdWare.Script.Generic\r\nПользователь: BLA\i.blablabla (Активный пользователь)\r\nОбъект: C:\users\i.blablabla\appdata\local\Google\Chrome\User Data\Default\Cache\f_000244\r\n

0 Karma

FrankVl
Ultra Champion

By default . doesn't match newline characters. You can try using [\r\n.]* instead of .*.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...