Splunk Search

How to get a field extraction match up till the first time a string is found?

jeck11
Path Finder

This is the regex I've come up with so far. Unfortunately, it's either matching too much or not enough. I want it to match everything after "Details: " until the first time "java." is found. Basically, I'm looking for everything in the orange boxes in the example image below.

^Details\:\s(?<Error_Details>.*)\sjava\.\w+\.\w+(\s|\:)

alt text

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would have been helpful to post the sample strings as text rather than as an image so we could test them in regex101.com.

Have you tried Details\:\s(?<Error_Details>[\s\S]*?)\sjava\.?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would have been helpful to post the sample strings as text rather than as an image so we could test them in regex101.com.

Have you tried Details\:\s(?<Error_Details>[\s\S]*?)\sjava\.?

---
If this reply helps you, Karma would be appreciated.
0 Karma

jeck11
Path Finder

I kind of see what you did there. The problem wasn't so much after the match as it was inside the match.

Details:\s(?[\s\S]*?)\sjava.\w+.\w+

Thank you very much for your assistance.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is it working now? If so, please accept the answer to help future readers. If not, please say where the answer is lacking.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jeck11
Path Finder

I'm sorry. I had clicked the accept and given the karma points. It's completely working now.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...