Splunk Search

How to write a regular expression for my use case?

sravankaripe
Communicator
11-01-2016 14:53:32.199 -0500 INFO  StreamedSearch - Streamed search connection terminated: search.......................

11-01-2016 15:01:31.638 -0500 WARN  DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event....................

i have a use case to display the messages for all log levels. Please help me in writing the rex for this case.

0 Karma
1 Solution

somesoni2
Revered Legend

Assuming the location of log_level field is fixed in your events (after timestamp), then give this a try

your base search | rex "^(\S+\s+){3}(?<log_level>\S+)"

View solution in original post

0 Karma

somesoni2
Revered Legend

Assuming the location of log_level field is fixed in your events (after timestamp), then give this a try

your base search | rex "^(\S+\s+){3}(?<log_level>\S+)"
0 Karma

ddrillic
Ultra Champion
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

Base Search | rex (?P<Messages>(?<=INFO|WARN).+\B)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...