Splunk Search

regex to extract each line having a specific keyword

maniishpawar
Path Finder

Hi ,

I am trying to extract each line having a keyword, till the end of that line.
below is my data and the query I tried so far.

my query | rex "RefillService(?P(.+)\s+)" | table myfield

its only showing first matching line "Start CalRefillService in refillRequestHandler"

DEBUG 2017-05-04 10:23:23,128 260497545ms refillWebApiController GetrefillData - =============================================
DEBUG 2017-05-04 10:23:23,128 260497545ms refillWebApiController GetrefillData - Processing Start:2017-5-4 10:23:23.128296
DEBUG 2017-05-04 10:23:23,190 260497608ms refillRequestHandler RefillService - Start CalRefillService in refillRequestHandler
DEBUG 2017-05-04 10:23:23,211 260497628ms refillRequestHandler RefillService - Completed basic validation in refillRequestHandler
DEBUG 2017-05-04 10:23:23,225 260497643ms refillRequestHandler RefillService - Generated Account code in refillRequestHandler
DEBUG 2017-05-04 10:23:23,225 260497643ms refillRequestHandler RefillService - Generated quote in refillRequestHandler
DEBUG 2017-05-04 10:23:23,241 260497658ms refillRequestHandler RefillService - Generated RequestXml in refillRequestHandler
DEBUG 2017-05-04 10:23:23,241 260497658ms refillResponseHandler ProcessResponse - Start ProcessResponse in refillResponseHandler: 2017-5-4 10:23:23.241291
DEBUG 2017-05-04 10:23:23,241 260497658ms refillResponseHandler ProcessResponse - Completed validations in refillResponseHandler
DEBUG 2017-05-04 10:23:23,241 260497658ms refillResponseHandler ProcessResponse - Call Start: 2017-5-4 10:23:23.241291

Tags (1)
0 Karma

alemarzu
Motivator

Hello there,

This will extract both lines from both keyworkds (RefillService, ProcessResponse):
| rex "(?:RefillService|ProcessResponse)\s-\s(?<my_custom_field1>[^\n]+)"

This will work only for RefillService line:
| rex "RefillService\s-\s(?<RefillService>[^\n]+)"

Hope it helps.

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...