Splunk Search

regular expression

bellaed
Path Finder

Help me with a regular expression to include all the log details after a certain field,including newline tab etc something(?P.*) is not working, it is excepting new line..
Thanks
Bella

0 Karma
1 Solution

Ayn
Legend

You need to need the s regex modifier.

(?s)(?<restoflogevent>.*)

http://www.regular-expressions.info/modifiers.html

View solution in original post

Ayn
Legend

You need to need the s regex modifier.

(?s)(?<restoflogevent>.*)

http://www.regular-expressions.info/modifiers.html

bellaed
Path Finder

With Build regex expression test it is working fine, but
...|table restoflogevent
gives the same result.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...