how to write Regex expression

[Paul_tcs]

Hi xperts,

Am new to splunk. I am uploading my data into the splunk. when i see the preview, it shows me all the events in the only line. i have the date 10:22:58 04/16/2013 as seprater. i want to break the line for new event after this type of time stamp. when i go through the kbs and articles, i found the term as regex..kindly help me how to write the regex with examples.

[gfuente · Accepted solution]

Here you go:

\d{2}:\d{2}:\d{2}\s\d{2}/\d{2}/\d{4}

Regards

[Paul_tcs]

really ur maverick...its worked....

[Paul_tcs]

can uhelp me how to write this regex..

[Paul_tcs]

10:22:58 04/16/2013 alert
alert-type: SNMPTrap
alert-name: Unix_CPU_Composite_Normal
alert-failed: true
alert-message: SiteScope/dbnk04p4/CPU & CPU Load/1/no items checked/10:22 AM 4/16/13
alert-monitor: CPU & CPU Load

10:22:59 04/16/2013 alert
alert-type: SNMPTrap
alert-name: Memory_Normal
alert-failed: true
alert-message: SiteScope/dbnk04p4/Memory/1/2% swap space used, 80280MB swap space free; 97% physical memory used, 882MB physical memory free/10:22 AM 4/16/13
alert-monitor: Memory

[gfuente]

Add a sample of data to make easier help you