Splunk Search

Regex to ignore [\r][\n]

saad_siddiqi
Path Finder

Hi there,

I have been trying to remove the below line which is a big part of one of the logs. Been trying with many regex types in transforms.conf but it doesn't recognize it when I a put in "[\r][\n]".

DEBUG - wire << "[\r][\n]"

I have tried many options like
"[\\r][\\n]"
"[\\r][\\n]\"
etc but still no luck.

Can anyone help me out with this.

Thanks

Tags (2)
0 Karma
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

try \[\\r\]\[\\n\]

You must escape not only the backslashes but also the square brackets.

View solution in original post

sbrant_splunk
Splunk Employee
Splunk Employee

try \[\\r\]\[\\n\]

You must escape not only the backslashes but also the square brackets.

saad_siddiqi
Path Finder

Yeah, I wanted not to index the lines DEBUG - wire << "[\r][\n]"

0 Karma

saad_siddiqi
Path Finder

That did the trick... Cheers mate!

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

BTW, this will match [\r][\n] but you mention "ignoring" the pattern. Do you mean that you've collected the data and you want to ignore those lines in your search results or do you mean that you'd like to not index the lines that contain that pattern?

0 Karma
Get Updates on the Splunk Community!

Buttercup Games Tutorial Extension - part 9

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games Tutorial Extension - part 8

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Introducing the Splunk Developer Program!

Hey Splunk community! We are excited to announce that Splunk is launching the Splunk Developer Program in ...