Splunk Search

Multiline regex capture and newlines

kevintelford
Path Finder

Kevins back with more corner cases!

So, I have events that will look something like

key1=value1
key2=value2
key3=value3
key4=value4
key5=value5
something
  the
  cake
  is
  a
  lie
--------------------------

or like this

key1=value1
key2=value2
key3=value3
key4=value4
key5=value5
something : 
  something else
  funny

So the kv pairs are taken care of, but I'd like to create a new event for my list of "somethings". But there could be any number of them, they could contain any characters, and there sometimes could be a line of dashes at the end. I thought about originally removing the dash lines altogether with the SEDCMD but they're the only consistent thing I can break events on.

So a regex that works on the search path is

| rex field=_raw "something\s*:\s(?s)(?<something_list>.*)"

and in a transforms.conf

REGEX = something\s*:\s(?s)(?<something_list>.*)

but the problem is it included the dashed lines.

So I tried this on the search path

| rex field=_raw "something\s*:\s(?s)(?<something_list>.*?)(:?\n-|$)"

Which worked, but when I put it in the transforms it did NOT work.

Now, when I was getting the value "something_list" the first thing I noticed is that all of my caputured values were getting munged. So the first regex would produce something_list=thecakeisalie-------------------------- and the second something_list=thecakeisalie. But then the second would only work from the search command and not my transforms and I'm wondering if perhaps newlines, in regexes and event creation, cause something wacky to happen inside of Splunk?

Thanks, Kevin

Tags (2)

fk319
Builder

I was gogling and found your question.

I was able to get a '.' to match everything by '(.|\r)'.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...