Splunk Search

Regex for getting only the bold?

f_666dhn
Explorer

I have field log-sshd like this:

log-sshd="Apr 5 xx:xx:xx serverhost sshd[xxxx]: Failed password for user xxx from xx.xx.xxx.xx port xxxx ssh2"

What is the SPL search if i just wanna get the word that i bolded ?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\]:(?<message>.*)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\]:(?<message>.*)"

f_666dhn
Explorer

Thanks

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...