Splunk Search

How to catch end of line symbols with regex?

avasilievnko
Explorer

I have symbols that mean end of line

\r\n

Example of string:

D:\INSTALL\_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

My regex looks like this

([a-zA-Z]:)(\\.*\\r\\n)

PS. log looks like this:

blablabla\r\n D:\INSTALL\_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

I need catch only line like this

D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n
Tags (2)
0 Karma
1 Solution

avasilievnko
Explorer

I win it with adding ? , it makes it non-greedy. regex: (?([a-zA-Z]:)(\.*?\r\n))

I can math only lines, like in the middle
blablabla\r\n D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

View solution in original post

0 Karma

avasilievnko
Explorer

I win it with adding ? , it makes it non-greedy. regex: (?([a-zA-Z]:)(\.*?\r\n))

I can math only lines, like in the middle
blablabla\r\n D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

0 Karma

javiergn
Super Champion

What about the following regex:

(\w\:[^\r\n]+)

Regards,
J

0 Karma

avasilievnko
Explorer

It's catch all log file, but i should rich and of the line in strings like this:
D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

(?([a-zA-Z]:)(\.*\r\n))

So that the following lines with \r\n are not caught

Need to stop regular expression at first match \r\n in line like this
D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

0 Karma

avasilievnko
Explorer

its's better , but it catch other lines with \r\n

Full log

Jun 5 14:39:40 blabla-pc.blabla.bla bla|10.3.0.0 Результат: Помещено на карантин: not-a-virus:HEUR:AdWare.Script.Generic\r\nПользователь: BLA\i.blablabla (Активный пользователь)\r\nОбъект: C:\users\i.blablabla\appdata\local\Google\Chrome\User Data\Default\Cache\f_000244\r\n

0 Karma

FrankVl
Ultra Champion

By default . doesn't match newline characters. You can try using [\r\n.]* instead of .*.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...