Splunk Search

Search-time extraction works, new field extraction doesn't

snickered
Path Finder

I have a sourcetype that has multi-line events. An example looks like this:

Jan07 12:45:18.57 | [Info ] | This is the message I want
Stuff : foo
More Stuff: bar
I can successfully pull out my desired data using rex during a search with:
rex field=_raw "\[Info\s\]\s\|\s(?<msg>.*)"

When I use the same regex in manager->fields it doesn't work. It actually grabs everything in the event all the way to the end and doesn't stop at the end of the line. However when I use the interactive field extractor it works as expected and highlights only the message I want to extract. How do I make it stop at the end of the line rather than the end of the event?

0 Karma
1 Solution

vincesesto
Communicator

Hey Snickered,
I have set up some test data to match your logs and when I use the extra fields option, I am seeing a different value compared to yours. I am getting the following rex "(?i)\[.? \] \| (?P.)"

Secondly, do you have any other information defined in your props.conf file to define the event...This could also hold a key to what is happening.

Regards Vince

View solution in original post

0 Karma

vincesesto
Communicator

Hey Snickered,
I have set up some test data to match your logs and when I use the extra fields option, I am seeing a different value compared to yours. I am getting the following rex "(?i)\[.? \] \| (?P.)"

Secondly, do you have any other information defined in your props.conf file to define the event...This could also hold a key to what is happening.

Regards Vince

0 Karma

snickered
Path Finder

Yeah, the interactive thing gave me something along those lines also but it was matching way too much (I also have [Warn ], [Error ], etc...), so I had to use my rex which worked in the interactive field extractor but simply didn't when set as a field extraction through the manager.

Anyway, I got it working with this: \[Info\s\]\s\|\s(?P[^\r\n]+)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...