Dashboards & Visualizations

Help required on regex

rangarbus
Path Finder

Hello Friends,

I am looking for your help for a rex expression.

message =  [2021-05-26 00:00:33,477] {taskinstance.py:669} INFO - Dependencies all met for <TaskInstance: example_dag_oidc.test_bash 2021-05-25 00:00:00+00:00 [None]> 

I would like to split this message field as below fields:

  • logDateTime = 2021-05-26 00:00:33,477
  • logLevel = INFO
  • logMessage = Dependencies all met for <TaskInstance: example_dag_oidc.test_bash 2021-05-25 00:00:00+00:00 [None]> 

Thanks

0 Karma
1 Solution

eddieddieddie
Path Finder

Try the following regex with the rex command:

 

"\[(?<logDateTime>[\d, :,-]+)\].+ (?<logLevel>\w+) - (?<logMessage>.+)"

 

In Splunk SPL it would look like this (assuming that the raw data is in a field called 'message'):

 

| rex field=message "\[(?<logDateTime>[\d, :,-]+)\].+ (?<logLevel>\w+) - (?<logMessage>.+)"
| table logDateTime logLevel logMessage

 

 

Hopefully that suits your needs?

Eddie

 

View solution in original post

0 Karma

eddieddieddie
Path Finder

Try the following regex with the rex command:

 

"\[(?<logDateTime>[\d, :,-]+)\].+ (?<logLevel>\w+) - (?<logMessage>.+)"

 

In Splunk SPL it would look like this (assuming that the raw data is in a field called 'message'):

 

| rex field=message "\[(?<logDateTime>[\d, :,-]+)\].+ (?<logLevel>\w+) - (?<logMessage>.+)"
| table logDateTime logLevel logMessage

 

 

Hopefully that suits your needs?

Eddie

 

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...