Hey Fellow Splunkers
I'm looking to possibly create a regular expression that can be used to extract a field. The data associated with the field that I'm attempting to extract is a complex string with numerical values including quotes example:
EXAMPLE DATA:
Aug 10 10:10:40 HOST SUPERTROOPERS: 10-08-2016 10:55:15 WARNING 555 ERRORS "THE ERROR IS 1 MORE THAN EXPECTED"
WARNING 344 Errors "THE ERROR IS 1 MORE THAN EXPECTED"
WARNING 210 Errors "THE ERROR IS 5 LESS THAN EXPECTED"
WARNING 122 Errors " SOME ADDITIONAL 1 TEXT"
The Regular Expression I generated:
rex field=ERROR ^(?:[^ \n]* ){5}(?P<ERROR>\s+"+*+")
the last part of the regular expression s+"*") is complex, I'm wandering how can i say all words, spaces, and numbers within " " to be associated with my field Errors.
I think this is saying new field name ERROR new line, non capture, except new line, and any value, 5 characters for in ERROR space than then this part would be to include everything within quotes?
My Goal is to simply create the field Error = quotes, words, spaces, numbers, and some more quotes.?
... View more