Splunk Search

Regex to extract whole line from raw data

nm8181
Engager

Hello,

I am trying to extract the full line from the raw data log matching a pattern in the line.  Sample data:

blah blah

24 packages updated on 5th may 2021 3:00 pm

blah blah

I am able to use a regex to extract everything after a pattern lets say "packages updated" using the below regex, but I am not able to extract the full line including the number (24 in this case) in the beginning of the line.

base search

| rex field=_raw "(?m)packages updated\s(?<pkg_count>.*)"

With this above regex, I get a new field named pkg_count with value of = on 5th may 2021 3:00 pm

But I'd like to get a field with the full line "24 packages updated on 5th may 2021 3:00 pm"

Thanks!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You're close.  Try this command

| rex field=_raw "(?<pkg_count>\d+)\s+packages updated\s(?<pkg_date>.*)"

The (?m) flag is not needed.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

nm8181
Engager

Perfect. Thank you!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You're close.  Try this command

| rex field=_raw "(?<pkg_count>\d+)\s+packages updated\s(?<pkg_date>.*)"

The (?m) flag is not needed.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...