Splunk Search

Regular Expression two words pattern

royimad
Builder

Hello Splunkers,

I have a log file as follow:
Time1 WARN a.b.c
Time2 ERROR 1.2.3
Time3 FATAL a.b.c
Time2 WARN a.b.c
Time4 WARN a.b.c

If i want to select all the fields after WARN , i can write a regular expression as:
(?i) WARN (?P[^ ]+)
This will select all the fields after WARN.

What do i need to change if i want to select with the same regular expression the fields after ERROR with the fields after WARN?

Thanks,

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

a) Time1 WARN some message here
b) Time2 ERROR some other message
c) Time3 FATAL yet another message

Given the events above, the following will happen

regex                                       your_field
(?i)(?:WARN|ERROR|FATAL)(?<your_field>[^ ]+)            some, some, yet (respectively)
(?i)(?:WARN|ERROR|FATAL)(?<your_field>.+)               the remainder of the events (including spaces)
(?i)(?:WARN|ERROR)(?<your_field>[^ ]+)                  some, some, null(respectively)

/k

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...