- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to edit my regex to extract this pattern from ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am trying to extract a pattern as below. Tried a few things, but all sorts of junk data is being picked up.
Event (Data)
2000-04-01T12:11:14,660 INFO [[abcdef4-abcdefghij].abcdEfghijklm.nopqrstu.21] [AbcDefghi] ABCD EFGH : ILIKEYO_KNOW | ABCDE FGHI : WAR_RIGG_IS_BAD | ABCDEF GH : XYZ1190560709120516-88328[ABCDEFG HIJKLM : 5.7_WOLFER]
Tried with the following
* | rex field=_raw "^(?:[^:\n]*:){5}\s+(?P[^\[]+)"
I am trying to extract the entire text (in bold). The above pattern gives me the text, but other fields are also getting matched. How can I strengthen the regex so that only this type of event gets analyzed?
Is it possible to use some of the text fields which would be unique (colored in blue), so that they can be used in a better way?
Thanks in Advance,
Koushik
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One way of doing it could be using the following regex:
| rex field=_raw "(?msi)\|[\w\s]+:\s+(?<pattern>[\w\s\-]+)\[[^\]]+\]$"
That will create a new field called pattern with the text in bold you were referring too.
If you wanted to include some of the text fields in blue that you reckon will be static you could, but the regex above is already extremely fast (just 22 steps to match what you are looking for).
Keep in mind your text in bold has to be an alphanumeric character, space or hyphen in order to match this: [\w\s-]+
If that's not the case you will need to include any new possible character that might appear between the square brackets.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One way of doing it could be using the following regex:
| rex field=_raw "(?msi)\|[\w\s]+:\s+(?<pattern>[\w\s\-]+)\[[^\]]+\]$"
That will create a new field called pattern with the text in bold you were referring too.
If you wanted to include some of the text fields in blue that you reckon will be static you could, but the regex above is already extremely fast (just 22 steps to match what you are looking for).
Keep in mind your text in bold has to be an alphanumeric character, space or hyphen in order to match this: [\w\s-]+
If that's not the case you will need to include any new possible character that might appear between the square brackets.
Introducing the Splunk Community Dashboard Challenge!
Get the T-shirt to Prove You Survived Splunk University Bootcamp
Wondering How to Build Resiliency in the Cloud?
