Splunk Search

regular expression for multi lineevent

darksky21
Path Finder

Hi i have an event

Filename : 1.htm
Content Type : text/html; charset=utf-8

how can i extract the (1.htm only)
i tried ending the string with space but the regex still give me (1.htm Content Type : text/html; charset=utf-8)

sorry new to regex

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

Hi

... | rex  "(?m)Filename\s+:\s+(?<file_name)[^\r\n]+)"

Should work. If you're happy, then you can put it in props.conf to make it more permanent;

[your_sourcetype]
EXTRACT-blah =  (?m)Filename\s+:\s+(?<file_name)[^\r\n]+)

Ayn
Legend

...well what's the regex you're using?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...