Splunk Search

Regex to match everything after the last occurence of a character

bcatwork
Path Finder

I did not anticipate I'd struggle this much for what seemed like such a simple task.

The logs I am trying to parse have all sorts of crap sandwiched into [brackets].

Examples:

[thread] [timestamp] [transactionID] logLevel {moreNonsense}

[thread] [timestamp] logLevel [transactionID] {moreNonsense}

I want the logLevel. To say, I want all the text after the last occurrence of ], but before the first occurrence of }
Using regular expressions, how can I state to only return the string following that last ]. There is no consistency in the character length or type of each bracketed field, there is also a variable number of bracket sets in each event, prior to the logLevel (2, 3 or 4 sets, dependent on the log source).

Each attempt I have made has yielded a logLevel value of everything following the very first closed bracket ]

0 Karma
1 Solution

sundareshr
Legend

If log_level can be multiple words, use this

.*\]\s*(?<log_level>[^\{]+)

OR if it is always single word, use this

.*\]\s*(?<log_level>\w+)\s*\{

OR if log_level is a finite list, try this

(?<log_level>INFO|WARN|DEBUG|CRITICAL)

View solution in original post

javiergn
SplunkTrust
SplunkTrust

What about this:

your base search
| rex "(\[[^\]]+\]\s?)+(?<logLevel>\w+)"

Example 1:

| stats count | fields - count
| eval _raw = "[thread] [timestamp] [transactionID] LOGLEVEL1 {moreNonsense}"
| rex "(\[[^\]]+\]\s?)+(?<logLevel>\w+)"

Output:

logLevel = LOGLEVEL1

Example 2:

| stats count | fields - count
| eval _raw = "[thread] [timestamp] LOGLEVEL2 [transactionID] {moreNonsense}"
| rex "(\[[^\]]+\]\s?)+(?<logLevel>\w+)"

Output:

logLevel = LOGLEVEL2
0 Karma

sundareshr
Legend

If log_level can be multiple words, use this

.*\]\s*(?<log_level>[^\{]+)

OR if it is always single word, use this

.*\]\s*(?<log_level>\w+)\s*\{

OR if log_level is a finite list, try this

(?<log_level>INFO|WARN|DEBUG|CRITICAL)
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...