Splunk Search

How to write the regex to extract and list values occurring after a constant string?

pavanae
Builder

The following were my search results:

processor.ProcSavePriceInfoObjects.writeProperties(ProcSavePriceInfoObjects.java:1424)
processor.ProcSavePriceInfoObjects.saveSubtotalPriceInfos(ProcSavePriceInfoObjects.java:1180)
processor.ProcSavePriceInfoObjects.saveShippingItemsSubtotalPriceInfos(ProcSavePriceInfoObjects.java:1076)
processor.ProcSavePriceInfoObjects.savePriceInfo(ProcSavePriceInfoObjects.java:1052)
processor.ProcSavePriceInfoObjects.saveOrderPriceInfo(ProcSavePriceInfoObjects.java:807)
processor.ProcSavePriceInfoObjects.runProcess(ProcSavePriceInfoObjects.java:716)

Now I want list out only the results occurring after the "processor.proc"

How to write a regex in Splunk as needed?

0 Karma
1 Solution

PGrantham
Path Finder

Something like:

index=<your index> | rex field=_raw "processor.Proc(?<new_field>[^\s]+)" | stats values(new_field)

This will create a new field called "new_field" and add everything after the "processor.Proc" up until the next space. If what you're showing is a single, multilined event, then you would need to add max_match=0 to the rex command and change the "\s" to a "\n". So it would look liked:

 index=<your index> | rex max_match=0 field=_raw "processor.Proc(?<new_field>[^\n]+)" | stats values(new_field)

Hope that helps.

View solution in original post

PGrantham
Path Finder

Something like:

index=<your index> | rex field=_raw "processor.Proc(?<new_field>[^\s]+)" | stats values(new_field)

This will create a new field called "new_field" and add everything after the "processor.Proc" up until the next space. If what you're showing is a single, multilined event, then you would need to add max_match=0 to the rex command and change the "\s" to a "\n". So it would look liked:

 index=<your index> | rex max_match=0 field=_raw "processor.Proc(?<new_field>[^\n]+)" | stats values(new_field)

Hope that helps.

richgalloway
SplunkTrust
SplunkTrust

Are we looking at a single field or the entire event?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...