Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: how to write Regex expression
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi xperts,
Am new to splunk. I am uploading my data into the splunk. when i see the preview, it shows me all the events in the only line. i have the date 10:22:58 04/16/2013 as seprater. i want to break the line for new event after this type of time stamp. when i go through the kbs and articles, i found the term as regex..kindly help me how to write the regex with examples.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here you go:
\d{2}:\d{2}:\d{2}\s\d{2}/\d{2}/\d{4}
Regards
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
really ur maverick...its worked....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
can uhelp me how to write this regex..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10:22:58 04/16/2013 alert
alert-type: SNMPTrap
alert-name: Unix_CPU_Composite_Normal
alert-failed: true
alert-message: SiteScope/dbnk04p4/CPU & CPU Load/1/no items checked/10:22 AM 4/16/13
alert-monitor: CPU & CPU Load
10:22:59 04/16/2013 alert
alert-type: SNMPTrap
alert-name: Memory_Normal
alert-failed: true
alert-message: SiteScope/dbnk04p4/Memory/1/2% swap space used, 80280MB swap space free; 97% physical memory used, 882MB physical memory free/10:22 AM 4/16/13
alert-monitor: Memory
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Add a sample of data to make easier help you
Observe and Secure All Apps with Splunk
Splunk Decoded: Business Transactions vs Business IQ
Fastest way to demo Observability
