How to edit my regular expression to grab the first line in a log?

[sankarms]

I have a log file like this:

Type: something/something; something
The next line

I want to write a Splunk search to grab the first line and create a pie chart of the various different types. The problem is the query I wrote is taking in The next line bit too which I don't want. Here's my query:

("Type: " OR "type: ") | rex field=_raw "(?<type>.*)\n" | stats count by type

How do I write a search that takes everything after the : but stops at the newline \n?

[niketn · Accepted solution]

As per regular expression standards, dot matches any single character except newline character provided regex is run with multiline (?m) regex flag. Following should work for you. You also need to specify match pattern to identify beginning of regular expression extraction i.e. Type:

| rex field=_raw "(?m)Type:\s(?<type>.*)"

PS: By default the regex flag is single line(?s), then dot matches newline character as well, hence you are seeing all the text selected, event from the second line.

Also once you have tested the rex command, make sure you move this from your search query to Knowledge object as a Field Extraction, for easy maintenance.

[gokadroid]

Try this please:

your query to return events
|  rex "Type:\s*(?<myType>[^\n\r]+)"
| stats count by myType

Use visualization as Pie Chart

See extraction here

[mrgibbon]

This should do it:

rex "somestring :(?P<type>[^\n]+)"

[sankarms]

So would my search be:

("Type: " OR "type: ") | rex field=_raw "(?P[^\n]+)" | stats count by type