Splunk Search

Regex not working for multiline events

namrithadeepak
Path Finder

Hi,

My logs look like this ...

AS RAW TEXT:

{"timestamp":"2019-08-08 10:23:38.320","level":"INFO","thread":"task-scheduler-8","mdc":{"TraceabilityID":"abcde","file_name":"MySampleFileName.json","Source":"SOURCE"},"logger":"MyApplicationLogConfig","message":" |IN001 |1010908 |Order placed Successfully. |\n |IN002 |1010909 |Order placed Successfully. |\n"}

SYNTAX HIGHLIGHTED:
alt text

WHAT I NEED:
1010908, 1010909 extracted as the OrderNum, Order placed Successfully as OrderStatus.

REGEX:

| rex field=message "(\n\s)*\|IN\d+\s\|(?<orderNum>\d+)\s\|(?<orderStatus>[\w\s]+)\.\s\|(\n)?"

ERROR IS:
The regex extracts only '1010908' as the OrderNum. I want both 1010908, 1010909 to be extracted.

Thanks in advance.

0 Karma

woodcock
Esteemed Legend

You need max_match=0, like this:

| makeresults
| eval _raw = "{\"timestamp\":\"2019-08-08 10:23:38.320\",\"level\":\"INFO\",\"thread\":\"task-scheduler-8\",\"mdc\":{\"TraceabilityID\":\"abcde\",\"file_name\":\"MySampleFileName.json\",\"Source\":\"SOURCE\"},\"logger\":\"MyApplicationLogConfig\",\"message\":\" |IN001 |1010908 |Order placed Successfully. |\n |IN002 |1010909 |Order placed Successfully. |\n\"}"
| spath
| rex field=message max_match=0 "(\n\s)*\|IN\d+\s\|(?<orderNum>\d+)\s\|(?<orderStatus>[\w\s]+)\.\s\|(\n)?"

Sukisen1981
Champion

can you paste the event as text , without a screen shot? that way we can work with the extraction

0 Karma

Sukisen1981
Champion

if you just append a max_match=0 , liker this to your regex, is it what you expect?

| rex field=message "(\n\s)*\|IN\d+\s\|(?<orderNum>\d+)\s\|(?<orderStatus>[\w\s]+)\.\s\|(\n)?" max_match=0
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...