Splunk Search

How to get a field extraction match up till the first time a string is found?

jeck11
Path Finder

This is the regex I've come up with so far. Unfortunately, it's either matching too much or not enough. I want it to match everything after "Details: " until the first time "java." is found. Basically, I'm looking for everything in the orange boxes in the example image below.

^Details\:\s(?<Error_Details>.*)\sjava\.\w+\.\w+(\s|\:)

alt text

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would have been helpful to post the sample strings as text rather than as an image so we could test them in regex101.com.

Have you tried Details\:\s(?<Error_Details>[\s\S]*?)\sjava\.?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would have been helpful to post the sample strings as text rather than as an image so we could test them in regex101.com.

Have you tried Details\:\s(?<Error_Details>[\s\S]*?)\sjava\.?

---
If this reply helps you, Karma would be appreciated.
0 Karma

jeck11
Path Finder

I kind of see what you did there. The problem wasn't so much after the match as it was inside the match.

Details:\s(?[\s\S]*?)\sjava.\w+.\w+

Thank you very much for your assistance.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is it working now? If so, please accept the answer to help future readers. If not, please say where the answer is lacking.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jeck11
Path Finder

I'm sorry. I had clicked the accept and given the karma points. It's completely working now.

0 Karma
Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...