Splunk Search

How to write a regular expression for my use case?

sravankaripe
Communicator
11-01-2016 14:53:32.199 -0500 INFO  StreamedSearch - Streamed search connection terminated: search.......................

11-01-2016 15:01:31.638 -0500 WARN  DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event....................

i have a use case to display the messages for all log levels. Please help me in writing the rex for this case.

0 Karma
1 Solution

somesoni2
Revered Legend

Assuming the location of log_level field is fixed in your events (after timestamp), then give this a try

your base search | rex "^(\S+\s+){3}(?<log_level>\S+)"

View solution in original post

0 Karma

somesoni2
Revered Legend

Assuming the location of log_level field is fixed in your events (after timestamp), then give this a try

your base search | rex "^(\S+\s+){3}(?<log_level>\S+)"
0 Karma

ddrillic
Ultra Champion
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

Base Search | rex (?P<Messages>(?<=INFO|WARN).+\B)
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...