Splunk Enterprise

Splunk regex ignore fields before match

leandromatperei
Path Finder

I need to extract the contents of the message field, but the first strings must be ignored, I need to get from the stdout field.
Any ideas how to do this?

Examples:

 

message: 2021-12-02T20:06:11.541111542Z stdout F 2021-12-02 17:06:11,540 Completed 200 OK

message: 2021-12-02T20:06:11.540863953Z stdout F     contract: txt (truncated)...]

message: 2021-12-02T20:06:11.540857713Z stdout F     clientDocument: txt

 

 

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "message:.+stdout (?<stdout>.+)"
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...