Splunk Search

how to write Regex expression

Paul_tcs
Explorer

Hi xperts,

Am new to splunk. I am uploading my data into the splunk. when i see the preview, it shows me all the events in the only line. i have the date 10:22:58 04/16/2013 as seprater. i want to break the line for new event after this type of time stamp. when i go through the kbs and articles, i found the term as regex..kindly help me how to write the regex with examples.

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

Here you go:

\d{2}:\d{2}:\d{2}\s\d{2}/\d{2}/\d{4}

Regards

View solution in original post

0 Karma

gfuente
Motivator

Here you go:

\d{2}:\d{2}:\d{2}\s\d{2}/\d{2}/\d{4}

Regards

0 Karma

Paul_tcs
Explorer

really ur maverick...its worked....

Paul_tcs
Explorer

can uhelp me how to write this regex..

0 Karma

Paul_tcs
Explorer

10:22:58 04/16/2013 alert
alert-type: SNMPTrap
alert-name: Unix_CPU_Composite_Normal
alert-failed: true
alert-message: SiteScope/dbnk04p4/CPU & CPU Load/1/no items checked/10:22 AM 4/16/13
alert-monitor: CPU & CPU Load

10:22:59 04/16/2013 alert
alert-type: SNMPTrap
alert-name: Memory_Normal
alert-failed: true
alert-message: SiteScope/dbnk04p4/Memory/1/2% swap space used, 80280MB swap space free; 97% physical memory used, 882MB physical memory free/10:22 AM 4/16/13
alert-monitor: Memory

0 Karma

gfuente
Motivator

Add a sample of data to make easier help you

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...