Splunk Search

Regex to ignore [\r][\n]

saad_siddiqi
Path Finder

Hi there,

I have been trying to remove the below line which is a big part of one of the logs. Been trying with many regex types in transforms.conf but it doesn't recognize it when I a put in "[\r][\n]".

DEBUG - wire << "[\r][\n]"

I have tried many options like
"[\\r][\\n]"
"[\\r][\\n]\"
etc but still no luck.

Can anyone help me out with this.

Thanks

Tags (2)
0 Karma
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

try \[\\r\]\[\\n\]

You must escape not only the backslashes but also the square brackets.

View solution in original post

sbrant_splunk
Splunk Employee
Splunk Employee

try \[\\r\]\[\\n\]

You must escape not only the backslashes but also the square brackets.

saad_siddiqi
Path Finder

Yeah, I wanted not to index the lines DEBUG - wire << "[\r][\n]"

0 Karma

saad_siddiqi
Path Finder

That did the trick... Cheers mate!

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

BTW, this will match [\r][\n] but you mention "ignoring" the pattern. Do you mean that you've collected the data and you want to ignore those lines in your search results or do you mean that you'd like to not index the lines that contain that pattern?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...