Splunk Search

how to write Regex expression

Paul_tcs
Explorer

Hi xperts,

Am new to splunk. I am uploading my data into the splunk. when i see the preview, it shows me all the events in the only line. i have the date 10:22:58 04/16/2013 as seprater. i want to break the line for new event after this type of time stamp. when i go through the kbs and articles, i found the term as regex..kindly help me how to write the regex with examples.

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

Here you go:

\d{2}:\d{2}:\d{2}\s\d{2}/\d{2}/\d{4}

Regards

View solution in original post

0 Karma

gfuente
Motivator

Here you go:

\d{2}:\d{2}:\d{2}\s\d{2}/\d{2}/\d{4}

Regards

0 Karma

Paul_tcs
Explorer

really ur maverick...its worked....

Paul_tcs
Explorer

can uhelp me how to write this regex..

0 Karma

Paul_tcs
Explorer

10:22:58 04/16/2013 alert
alert-type: SNMPTrap
alert-name: Unix_CPU_Composite_Normal
alert-failed: true
alert-message: SiteScope/dbnk04p4/CPU & CPU Load/1/no items checked/10:22 AM 4/16/13
alert-monitor: CPU & CPU Load

10:22:59 04/16/2013 alert
alert-type: SNMPTrap
alert-name: Memory_Normal
alert-failed: true
alert-message: SiteScope/dbnk04p4/Memory/1/2% swap space used, 80280MB swap space free; 97% physical memory used, 882MB physical memory free/10:22 AM 4/16/13
alert-monitor: Memory

0 Karma

gfuente
Motivator

Add a sample of data to make easier help you

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...