Splunk Search

How to catch end of line symbols with regex?

avasilievnko
Explorer

I have symbols that mean end of line

\r\n

Example of string:

D:\INSTALL\_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

My regex looks like this

([a-zA-Z]:)(\\.*\\r\\n)

PS. log looks like this:

blablabla\r\n D:\INSTALL\_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

I need catch only line like this

D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n
Tags (2)
0 Karma
1 Solution

avasilievnko
Explorer

I win it with adding ? , it makes it non-greedy. regex: (?([a-zA-Z]:)(\.*?\r\n))

I can math only lines, like in the middle
blablabla\r\n D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

View solution in original post

0 Karma

avasilievnko
Explorer

I win it with adding ? , it makes it non-greedy. regex: (?([a-zA-Z]:)(\.*?\r\n))

I can math only lines, like in the middle
blablabla\r\n D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

0 Karma

javiergn
Super Champion

What about the following regex:

(\w\:[^\r\n]+)

Regards,
J

0 Karma

avasilievnko
Explorer

It's catch all log file, but i should rich and of the line in strings like this:
D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

(?([a-zA-Z]:)(\.*\r\n))

So that the following lines with \r\n are not caught

Need to stop regular expression at first match \r\n in line like this
D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

0 Karma

avasilievnko
Explorer

its's better , but it catch other lines with \r\n

Full log

Jun 5 14:39:40 blabla-pc.blabla.bla bla|10.3.0.0 Результат: Помещено на карантин: not-a-virus:HEUR:AdWare.Script.Generic\r\nПользователь: BLA\i.blablabla (Активный пользователь)\r\nОбъект: C:\users\i.blablabla\appdata\local\Google\Chrome\User Data\Default\Cache\f_000244\r\n

0 Karma

FrankVl
Ultra Champion

By default . doesn't match newline characters. You can try using [\r\n.]* instead of .*.

0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...