Hello Splunkers,
I have a log file as follow:
Time1 WARN a.b.c
Time2 ERROR 1.2.3
Time3 FATAL a.b.c
Time2 WARN a.b.c
Time4 WARN a.b.c
If i want to select all the fields after WARN , i can write a regular expression as:
(?i) WARN (?P
This will select all the fields after WARN.
What do i need to change if i want to select with the same regular expression the fields after ERROR with the fields after WARN?
Thanks,
a) Time1 WARN some message here
b) Time2 ERROR some other message
c) Time3 FATAL yet another message
Given the events above, the following will happen
regex your_field
(?i)(?:WARN|ERROR|FATAL)(?<your_field>[^ ]+) some, some, yet (respectively)
(?i)(?:WARN|ERROR|FATAL)(?<your_field>.+) the remainder of the events (including spaces)
(?i)(?:WARN|ERROR)(?<your_field>[^ ]+) some, some, null(respectively)
/k