Splunk Search

How to catch end of line symbols with regex?

avasilievnko
Explorer

I have symbols that mean end of line

\r\n

Example of string:

D:\INSTALL\_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

My regex looks like this

([a-zA-Z]:)(\\.*\\r\\n)

PS. log looks like this:

blablabla\r\n D:\INSTALL\_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

I need catch only line like this

D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n
Tags (2)
0 Karma
1 Solution

avasilievnko
Explorer

I win it with adding ? , it makes it non-greedy. regex: (?([a-zA-Z]:)(\.*?\r\n))

I can math only lines, like in the middle
blablabla\r\n D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

View solution in original post

0 Karma

avasilievnko
Explorer

I win it with adding ? , it makes it non-greedy. regex: (?([a-zA-Z]:)(\.*?\r\n))

I can math only lines, like in the middle
blablabla\r\n D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

0 Karma

javiergn
Super Champion

What about the following regex:

(\w\:[^\r\n]+)

Regards,
J

0 Karma

avasilievnko
Explorer

It's catch all log file, but i should rich and of the line in strings like this:
D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

(?([a-zA-Z]:)(\.*\r\n))

So that the following lines with \r\n are not caught

Need to stop regular expression at first match \r\n in line like this
D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

0 Karma

avasilievnko
Explorer

its's better , but it catch other lines with \r\n

Full log

Jun 5 14:39:40 blabla-pc.blabla.bla bla|10.3.0.0 Результат: Помещено на карантин: not-a-virus:HEUR:AdWare.Script.Generic\r\nПользователь: BLA\i.blablabla (Активный пользователь)\r\nОбъект: C:\users\i.blablabla\appdata\local\Google\Chrome\User Data\Default\Cache\f_000244\r\n

0 Karma

FrankVl
Ultra Champion

By default . doesn't match newline characters. You can try using [\r\n.]* instead of .*.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...