Splunk Search

regx

Siddharthnegi
Contributor

Hi , I want to extract this line from an event.
RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy;

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| rex "^(?<line>.*proxy)"

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Siddharthnegi ,

could you share some sample of your full message, highlighting in bold the part to extract?

Ciao.

Giuseppe

0 Karma

Siddharthnegi
Contributor

I want to extract whole line till proxy
RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy;

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| rex "^(?<line>.*proxy)"

Siddharthnegi
Contributor

what if  I want to remove RAISE-ALARM from staring

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "^RAISE-ALARM(?<line>.*proxy)"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...