How to write the regex to extract and list values occurring after a constant string?

[pavanae]

The following were my search results:

processor.ProcSavePriceInfoObjects.writeProperties(ProcSavePriceInfoObjects.java:1424)
processor.ProcSavePriceInfoObjects.saveSubtotalPriceInfos(ProcSavePriceInfoObjects.java:1180)
processor.ProcSavePriceInfoObjects.saveShippingItemsSubtotalPriceInfos(ProcSavePriceInfoObjects.java:1076)
processor.ProcSavePriceInfoObjects.savePriceInfo(ProcSavePriceInfoObjects.java:1052)
processor.ProcSavePriceInfoObjects.saveOrderPriceInfo(ProcSavePriceInfoObjects.java:807)
processor.ProcSavePriceInfoObjects.runProcess(ProcSavePriceInfoObjects.java:716)

Now I want list out only the results occurring after the "processor.proc"

How to write a regex in Splunk as needed?

[PGrantham · Accepted solution]

Something like:

index=<your index> | rex field=_raw "processor.Proc(?<new_field>[^\s]+)" | stats values(new_field)

This will create a new field called "new_field" and add everything after the "processor.Proc" up until the next space. If what you're showing is a single, multilined event, then you would need to add max_match=0 to the rex command and change the "\s" to a "\n". So it would look liked:

 index=<your index> | rex max_match=0 field=_raw "processor.Proc(?<new_field>[^\n]+)" | stats values(new_field)

Hope that helps.

[richgalloway]

Are we looking at a single field or the entire event?