Splunk Search

Regex to ignore [\r][\n]

saad_siddiqi
Path Finder

Hi there,

I have been trying to remove the below line which is a big part of one of the logs. Been trying with many regex types in transforms.conf but it doesn't recognize it when I a put in "[\r][\n]".

DEBUG - wire << "[\r][\n]"

I have tried many options like
"[\\r][\\n]"
"[\\r][\\n]\"
etc but still no luck.

Can anyone help me out with this.

Thanks

Tags (2)
0 Karma
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

try \[\\r\]\[\\n\]

You must escape not only the backslashes but also the square brackets.

View solution in original post

sbrant_splunk
Splunk Employee
Splunk Employee

try \[\\r\]\[\\n\]

You must escape not only the backslashes but also the square brackets.

saad_siddiqi
Path Finder

Yeah, I wanted not to index the lines DEBUG - wire << "[\r][\n]"

0 Karma

saad_siddiqi
Path Finder

That did the trick... Cheers mate!

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

BTW, this will match [\r][\n] but you mention "ignoring" the pattern. Do you mean that you've collected the data and you want to ignore those lines in your search results or do you mean that you'd like to not index the lines that contain that pattern?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...