Splunk Search

How to catch end of line symbols with regex?

avasilievnko
Explorer

I have symbols that mean end of line

\r\n

Example of string:

D:\INSTALL\_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

My regex looks like this

([a-zA-Z]:)(\\.*\\r\\n)

PS. log looks like this:

blablabla\r\n D:\INSTALL\_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

I need catch only line like this

D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n
Tags (2)
0 Karma
1 Solution

avasilievnko
Explorer

I win it with adding ? , it makes it non-greedy. regex: (?([a-zA-Z]:)(\.*?\r\n))

I can math only lines, like in the middle
blablabla\r\n D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

View solution in original post

0 Karma

avasilievnko
Explorer

I win it with adding ? , it makes it non-greedy. regex: (?([a-zA-Z]:)(\.*?\r\n))

I can math only lines, like in the middle
blablabla\r\n D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n blablabla\r\n

0 Karma

javiergn
Super Champion

What about the following regex:

(\w\:[^\r\n]+)

Regards,
J

0 Karma

avasilievnko
Explorer

It's catch all log file, but i should rich and of the line in strings like this:
D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

(?([a-zA-Z]:)(\.*\r\n))

So that the following lines with \r\n are not caught

Need to stop regular expression at first match \r\n in line like this
D:\INSTALL_SysinternalsSuite\processhacker-2.39-bin\x86\r\n

0 Karma

avasilievnko
Explorer

its's better , but it catch other lines with \r\n

Full log

Jun 5 14:39:40 blabla-pc.blabla.bla bla|10.3.0.0 Результат: Помещено на карантин: not-a-virus:HEUR:AdWare.Script.Generic\r\nПользователь: BLA\i.blablabla (Активный пользователь)\r\nОбъект: C:\users\i.blablabla\appdata\local\Google\Chrome\User Data\Default\Cache\f_000244\r\n

0 Karma

FrankVl
Ultra Champion

By default . doesn't match newline characters. You can try using [\r\n.]* instead of .*.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...