Splunk Search

How to write the regex to extract and list values occurring after a constant string?

Builder

The following were my search results:

processor.ProcSavePriceInfoObjects.writeProperties(ProcSavePriceInfoObjects.java:1424)
processor.ProcSavePriceInfoObjects.saveSubtotalPriceInfos(ProcSavePriceInfoObjects.java:1180)
processor.ProcSavePriceInfoObjects.saveShippingItemsSubtotalPriceInfos(ProcSavePriceInfoObjects.java:1076)
processor.ProcSavePriceInfoObjects.savePriceInfo(ProcSavePriceInfoObjects.java:1052)
processor.ProcSavePriceInfoObjects.saveOrderPriceInfo(ProcSavePriceInfoObjects.java:807)
processor.ProcSavePriceInfoObjects.runProcess(ProcSavePriceInfoObjects.java:716)

Now I want list out only the results occurring after the "processor.proc"

How to write a regex in Splunk as needed?

0 Karma
1 Solution

Path Finder

Something like:

index=<your index> | rex field=_raw "processor.Proc(?<new_field>[^\s]+)" | stats values(new_field)

This will create a new field called "new_field" and add everything after the "processor.Proc" up until the next space. If what you're showing is a single, multilined event, then you would need to add max_match=0 to the rex command and change the "\s" to a "\n". So it would look liked:

 index=<your index> | rex max_match=0 field=_raw "processor.Proc(?<new_field>[^\n]+)" | stats values(new_field)

Hope that helps.

View solution in original post

Path Finder

Something like:

index=<your index> | rex field=_raw "processor.Proc(?<new_field>[^\s]+)" | stats values(new_field)

This will create a new field called "new_field" and add everything after the "processor.Proc" up until the next space. If what you're showing is a single, multilined event, then you would need to add max_match=0 to the rex command and change the "\s" to a "\n". So it would look liked:

 index=<your index> | rex max_match=0 field=_raw "processor.Proc(?<new_field>[^\n]+)" | stats values(new_field)

Hope that helps.

View solution in original post

SplunkTrust
SplunkTrust

Are we looking at a single field or the entire event?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!