Splunk Search

RegEx Pattern for Event Break in SourceType

neiowe
Path Finder

Hi all,

I am trying to determine the RegEx pattern for the Event Break. Below is an example event. A new event starts on the line preceding the "Information Message: Processing file:" text. The process number and the timestamp varies on the first line as does the info that follows "Information Message: Processing file:" until the next event starts.

1050746893 2016-11-25 05:36:02,518 [7] DEBUG DealerTrackImageDecoder, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -
Information Message: Processing file: C:\dealertrack\contracts\0C075017-0-1899123053557contract.xml


Thanks in advance for any help,

Neil

0 Karma

neiowe
Path Finder

Thanks. I wish it was that easy. That 10 digit number is the process number and is included on each process entry. However, there are most time multiple processes that make up what I am wanting to be a single event. The text "Information Message: Processing file:" on the second line is what indicates that a new file is being processed. I want to include all processes below that until the next "Information Message: Processing file:" into a single event.

I can use "Information Message: Processing file:" as the pattern and that gets me close, but I need the line right before "Information Message: Processing file:" to be included in the event also.

0 Karma

gokadroid
Motivator

Can you check if this regex works for event breaker:

^\d{10}\s
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...