Splunk Search

Rex to filter To remove multiline log entry

Tijil480
Observer

Please find the below single Log entry with multiple lines:

>Validation results 

   Message 1) sucess: true 

   Message 2) sucess: false 

   Reason : All is an invalid log event type 

   Message 3) sucess: true 

......

Need rex to fetch only false with reason lines.

Remaining needs to be ignored.

Tried below rex not getting proper results.

|Rex field=_raw "(?ms)(?<result>(.*)(?:true)"|table result

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

| rex "(?<result>false[\s\S]*)Message"
| table result
---
If this reply helps you, Karma would be appreciated.
0 Karma

Tijil480
Observer

Still it fetches sucess: true 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

regex101.com disagrees. https://regex101.com/r/deZogv/1

---
If this reply helps you, Karma would be appreciated.
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

To just get the reason:

| rex "(?ms)sucess: false[^\n]\n(?<field>[^\n]+)"

To get both lines:

| rex "(?ms)(?<field>[^\n]+sucess: false[^\n]+\n[^\n]+)"

 

0 Karma

Tijil480
Observer

Both queries are not returning any reaults

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Perhaps if you could share some more realistic log data (anonymised of course) it might help us work out what may be going wrong

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Did you try this?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...