Splunk Search

How to edit my regular expression to grab the first line in a log?

sankarms
Explorer

I have a log file like this:

Type: something/something; something
The next line

I want to write a Splunk search to grab the first line and create a pie chart of the various different types. The problem is the query I wrote is taking in The next line bit too which I don't want. Here's my query:

("Type: " OR "type: ") | rex field=_raw "(?<type>.*)\n" | stats count by type

How do I write a search that takes everything after the : but stops at the newline \n?

0 Karma
1 Solution

niketn
Legend

As per regular expression standards, dot matches any single character except newline character provided regex is run with multiline (?m) regex flag. Following should work for you. You also need to specify match pattern to identify beginning of regular expression extraction i.e. Type:

| rex field=_raw "(?m)Type:\s(?<type>.*)"

PS: By default the regex flag is single line(?s), then dot matches newline character as well, hence you are seeing all the text selected, event from the second line.

Also once you have tested the rex command, make sure you move this from your search query to Knowledge object as a Field Extraction, for easy maintenance.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

As per regular expression standards, dot matches any single character except newline character provided regex is run with multiline (?m) regex flag. Following should work for you. You also need to specify match pattern to identify beginning of regular expression extraction i.e. Type:

| rex field=_raw "(?m)Type:\s(?<type>.*)"

PS: By default the regex flag is single line(?s), then dot matches newline character as well, hence you are seeing all the text selected, event from the second line.

Also once you have tested the rex command, make sure you move this from your search query to Knowledge object as a Field Extraction, for easy maintenance.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

gokadroid
Motivator

Try this please:

your query to return events
|  rex "Type:\s*(?<myType>[^\n\r]+)"
| stats count by myType

Use visualization as Pie Chart

See extraction here

0 Karma

mrgibbon
Contributor

This should do it:

rex "somestring :(?P<type>[^\n]+)"
0 Karma

sankarms
Explorer

So would my search be:

("Type: " OR "type: ") | rex field=_raw "(?P[^\n]+)" | stats count by type

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...