Splunk Search

How to edit my rex statement to ignore line breaks to extract the entire value for a certain field?

marcosrios
Explorer

Hello,

I have an event like this:

2016-03-04 00:02:05,546 DEBUG [net.ussouth.aps.shared.util.SysLogUtil] <?xml version="1.0" encoding="UTF-8"?>
<TxnReq xmlns="http://www.us-south.net/namespace/Transaction"><ReqCat>fastcard</ReqCat><ReqAction>Act</ReqAction><ReqRoute>dbservice</ReqRoute><TraceUID>8a848b8d531f68940153400111f417ae</TraceUID><MerchDate>20160304</MerchDate><MerchTime>000206</MerchTime><Product><Track1>;0987789000000000=</Track1><Track2>0987789000000000=</Track2><ExtSerNum>0987789000000000</ExtSerNum><UPC>07675004668</UPC><Denom>840</Denom><Amount>5.0</Amount></Product><Origin><MerchID>Toys R Us</MerchID><StoreID>05927      TOYS</StoreID><TermID>05927100</TermID><TermType>FCMS</TermType><SrcRefNum>087591</SrcRefNum></Origin><Extension><Name>49</Name><Value>USD</Value></Extension><Extension><Name>59</Name><Value>0200      08759105927      TOYS.05927100</Value></Extension><TxnContext><HdrId>53746565</HdrId><ExecutionId>87077798</ExecutionId><StepNbr>1</StepNbr><IncommTransId>8a848b8d531f68940153400111f417ae</IncommTransId><NoPrevTxnFound>false</NoPrevTxnFound></TxnContext></TxnReq>

and I'm using this regex to get some fields from it:

| rex "(?<timestamp>(\d{4}-\d{2}-\d{2} \d{2}\:\d{2}\:\d{2}\,\d{3})) (?<loglevel>DEBUG|INFO|WARN|ERROR) (?<origin>\[.*\]) (?<content>.*)" | table timestamp, loglevel, origin, content

I can get all the fields ok except for content that is stopping when it finds a linebreak in the text. How can I make it get all the remaining text and set it in the (content) field?

Regards!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try using the single-line modifier by putting "(?s)" at the beginning of your regex string.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using the single-line modifier by putting "(?s)" at the beginning of your regex string.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...