Splunk Search

Regex in splunk

malgru
New Member

Hello

I am trying to get a regex to work in splunk but without success, perhaps someone here can help me?

This work when I am testing (not in splunk)

", logdata="Process Code: -400
Process Message: [0]:ABC QRT 12764 NOT. <-PurchaseOrderLineId- HeadId:1415640 Division:10 Id:1-1>", marowver="7"

But how do I get an expression that works in Splunk? I want the string in bold: ABC QRT 12764 NOT

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help to see your existing regex efforts.

Perhaps this will help: Process Message: \[\d+]:(?<processMessage>[\w\s]+)

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

malgru
New Member

The regex that I got and work in other environments (Not Splunk ) is
(?<=Process Message)(.*)(?=<-DBTransaction)

Somehow it was not included in the my initial post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to see your existing regex efforts.

Perhaps this will help: Process Message: \[\d+]:(?<processMessage>[\w\s]+)

---
If this reply helps you, Karma would be appreciated.
0 Karma

malgru
New Member

I just modified your example a little and it worked just fine, thanks

"(?<=Process Message:) \[\d+]:(?< basic_error_message>[\w\s]+)"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...