Splunk Search

Regex to match everything after the last occurence of a character

bcatwork
Path Finder

I did not anticipate I'd struggle this much for what seemed like such a simple task.

The logs I am trying to parse have all sorts of crap sandwiched into [brackets].

Examples:

[thread] [timestamp] [transactionID] logLevel {moreNonsense}

[thread] [timestamp] logLevel [transactionID] {moreNonsense}

I want the logLevel. To say, I want all the text after the last occurrence of ], but before the first occurrence of }
Using regular expressions, how can I state to only return the string following that last ]. There is no consistency in the character length or type of each bracketed field, there is also a variable number of bracket sets in each event, prior to the logLevel (2, 3 or 4 sets, dependent on the log source).

Each attempt I have made has yielded a logLevel value of everything following the very first closed bracket ]

0 Karma
1 Solution

sundareshr
Legend

If log_level can be multiple words, use this

.*\]\s*(?<log_level>[^\{]+)

OR if it is always single word, use this

.*\]\s*(?<log_level>\w+)\s*\{

OR if log_level is a finite list, try this

(?<log_level>INFO|WARN|DEBUG|CRITICAL)

View solution in original post

javiergn
SplunkTrust
SplunkTrust

What about this:

your base search
| rex "(\[[^\]]+\]\s?)+(?<logLevel>\w+)"

Example 1:

| stats count | fields - count
| eval _raw = "[thread] [timestamp] [transactionID] LOGLEVEL1 {moreNonsense}"
| rex "(\[[^\]]+\]\s?)+(?<logLevel>\w+)"

Output:

logLevel = LOGLEVEL1

Example 2:

| stats count | fields - count
| eval _raw = "[thread] [timestamp] LOGLEVEL2 [transactionID] {moreNonsense}"
| rex "(\[[^\]]+\]\s?)+(?<logLevel>\w+)"

Output:

logLevel = LOGLEVEL2
0 Karma

sundareshr
Legend

If log_level can be multiple words, use this

.*\]\s*(?<log_level>[^\{]+)

OR if it is always single word, use this

.*\]\s*(?<log_level>\w+)\s*\{

OR if log_level is a finite list, try this

(?<log_level>INFO|WARN|DEBUG|CRITICAL)
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...