How to handle \n in regex

[ppatkar]

In some of the events, I have '\n' in the events :

message: org.springframework.jdbc.UncategorizedSQLException: CallableStatementCallback; uncategorized SQLException for SQL <{call XYZ_API.PROCESS_EVENT(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)}>; SQL state <16000>; error code <20011>; ORA-00060: deadlock detected while waiting for resource\nORA-06512: at "ABC_OWNER.XYZ_API", line 5133\nORA-06512: at "ABC_OWNER.XYZ_API", line 2001\nORA-06512: at "ABC_OWNER.XYZ_API", line 6829\nORA-06512: at line 1\n; nested exception is java.sql.SQLException: ORA-00060: deadlock detected while waiting for resource\nORA-06512: at "ABC_OWNER.XYZ_API", line 5133\nORA-06512: at "ABC_OWNER.XYZ_API", line 2001\nORA-06512: at "ABC_OWNER.XYZ_API", line 6829\nORA-06512: at line 1\n'

Although my regex (message:\s(?<METADATA_ERROR>[^\\\n]+))  to extract until the first '\n'  appears in the event works :

https://regex101.com/r/XwEg29/1

When I try on Splunk, it extracts only   'org.spri' 

Do we need to handle \n differently in Splunk ?

[ITWhisperer · Accepted solution]

You need a couple more backslashes

(message:\s(?<METADATA_ERROR>[^\\\\\n]+))