Splunk Search

preamble_regex not working on UI

ygdrassilp
Explorer

Hello Im having a problem and my mind is already heated looking for the answer, here is a screenshot of what im trying to do PREAMBLE_REGEX is not working here are the examples of my logs. I even tried to test my regex here https://regex101.com/ and it is working perfectly fine. im trying to remove the 2nd line of the logs and it is said in the documentation that PREAMBLE_REGEX is the key to ignore preamble lines. here is the link for my reference in preamble_regex https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?utm_source=answers&utm_medium=in... .Please help me where i am wrong.

Im loosing my mind here.

"cdrRecordType","globalCallID_callManagerId","globalCallID_callId","origLegCallIdentifier","dateTimeOrigination","origNodeId","origSpan","origIpAddr","callingPartyNumber","callingPartyUnicodeLoginUserID","origCause_location","origCause_value","origPrecedenceLevel","origMediaTransportAddress_IP","origMediaTransportAddress_Port","origMediaCap_payloadCapability","origMediaCap_maxFramesPerPacket","origMediaCap_g723BitRate","origVideoCap_Codec","origVideoCap_Bandwidth","origVideoCap_Resolution","origVideoTransportAddress_IP","origVideoTransportAddress_Port","origRSVPAudioStat","origRSVPVideoStat","destLegIdentifier","destNodeId","destSpan","destIpAddr","originalCalledPartyNumber","finalCalledPartyNumber","finalCalledPartyUnicodeLoginUserID","destCause_location","destCause_value","destPrecedenceLevel","destMediaTransportAddress_IP","destMediaTransportAddress_Port","destMediaCap_payloadCapability","destMediaCap_maxFramesPerPacket","destMediaCap_g723BitRate","destVideoCap_Codec","destVideoCap_Bandwidth","destVideoCap_Resolution","destVideoTransportAddress_IP","destVideoTransportAddress_Port","destRSVPAudioStat","destRSVPVideoStat","dateTimeConnect","dateTimeDisconnect","lastRedirectDn","pkid","originalCalledPartyNumberPartition","callingPartyNumberPartition","finalCalledPartyNumberPartition","lastRedirectDnPartition","duration","origDeviceName","destDeviceName","origCallTerminationOnBehalfOf","destCallTerminationOnBehalfOf","origCalledPartyRedirectOnBehalfOf","lastRedirectRedirectOnBehalfOf","origCalledPartyRedirectReason","lastRedirectRedirectReason","destConversationId","globalCallId_ClusterID","joinOnBehalfOf","comment","authCodeDescription","authorizationLevel","clientMatterCode","origDTMFMethod","destDTMFMethod","callSecuredStatus","origConversationId","origMediaCap_Bandwidth","destMediaCap_Bandwidth","authorizationCodeValue","outpulsedCallingPartyNumber","outpulsedCalledPartyNumber","origIpv4v6Addr","destIpv4v6Addr","origVideoCap_Codec_Channel2","origVideoCap_Bandwidth_Channel2","origVideoCap_Resolution_Channel2","origVideoTransportAddress_IP_Channel2","origVideoTransportAddress_Port_Channel2","origVideoChannel_Role_Channel2","destVideoCap_Codec_Channel2","destVideoCap_Bandwidth_Channel2","destVideoCap_Resolution_Channel2","destVideoTransportAddress_IP_Channel2","destVideoTransportAddress_Port_Channel2","destVideoChannel_Role_Channel2","IncomingProtocolID","IncomingProtocolCallRef","OutgoingProtocolID","OutgoingProtocolCallRef","currentRoutingReason","origRoutingReason","lastRedirectingRoutingReason","huntPilotPartition","huntPilotDN","calledPartyPatternUsage","IncomingICID","IncomingOrigIOI","IncomingTermIOI","OutgoingICID","OutgoingOrigIOI","OutgoingTermIOI","outpulsedOriginalCalledPartyNumber","outpulsedLastRedirectingNumber","wasCallQueued","totalWaitTimeInQueue","callingPartyNumber_uri","originalCalledPartyNumber_uri","finalCalledPartyNumber_uri","lastRedirectDn_uri","mobileCallingPartyNumber","finalMobileCalledPartyNumber","origMobileDeviceName","destMobileDeviceName","origMobileCallDuration","destMobileCallDuration","mobileCallType","originalCalledPartyPattern","finalCalledPartyPattern","lastRedirectingPartyPattern","huntPilotPattern"
INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,VARCHAR(50),VARCHAR(128),INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,VARCHAR(64),VARCHAR(64),INTEGER,INTEGER,INTEGER,INTEGER,VARCHAR(50),VARCHAR(50),VARCHAR(128),INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,VARCHAR(64),VARCHAR(64),INTEGER,INTEGER,VARCHAR(50),UNIQUEIDENTIFIER,VARCHAR(50),VARCHAR(50),VARCHAR(50),VARCHAR(50),INTEGER,VARCHAR(129),VARCHAR(129),INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,VARCHAR(50),INTEGER,VARCHAR(2048),VARCHAR(50),INTEGER,VARCHAR(32),INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,VARCHAR(32),VARCHAR(50),VARCHAR(50),VARCHAR(64),VARCHAR(64),INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,INTEGER,VARCHAR(32),INTEGER,VARCHAR(32),INTEGER,INTEGER,INTEGER,VARCHAR(50),VARCHAR(50),INTEGER,VARCHAR(50),VARCHAR(50),VARCHAR(50),VARCHAR(50),VARCHAR(50),VARCHAR(50),VARCHAR(50),VARCHAR(50),INTEGER,INTEGER,VARCHAR(255),VARCHAR(255),VARCHAR(255),VARCHAR(255),VARCHAR(50),VARCHAR(50),VARCHAR(129),VARCHAR(129),INTEGER,INTEGER,INTEGER,VARCHAR(50),VARCHAR(50),VARCHAR(50),VARCHAR(50)
1,1,218478,18189622,1425443400,1,0,-1391850998,"257","",0,16,4,-1391850998,16386,4,20,0,0,0,0,0,0,"0","0",18189628,1,0,50989578,"215","720","",0,0,4,50989578,19460,4,20,0,0,0,0,0,0,"0","0",1425443433,1425443437,"742","441fd7b3-4f6f-44f5-90c3-d1a2d46e80cd","Internal_PT","Internal_PT","Internal_PT","Internal_PT",4,"SEPE0D1730BB1F1","TAP-CUC-VI1",12,0,5,5,2,15,0,"StandAloneCluster",5,"","",0,"",3,3,0,0,64,64,"","","","10.10.10.173","10.10.10.3",0,0,0,0,0,0,0,0,0,0,0,0,0,"",0,"",0,0,0,"15db15ce-0c12-2273-383c-ee7d6f30c842","720",7,"","","","","","","","",0,0,"","","","","","","","",0,0,0,"215","720","742","720"
1,1,218475,18189609,1425443314,1,0,420088330,"423","",0,16,4,420088330,16392,4,20,0,0,0,0,0,0,"0","0",18189610,1,0,1292503562,"505","505","",0,0,4,1292503562,16390,4,20,0,0,0,0,0,0,"0","0",1425443316,1425443444,"505","720051a4-73af-48e9-ae06-cb9c8ef24df8","Internal_PT","Internal_PT","Internal_PT","Internal_PT",128,"SEPE0D1730A8BDD","SEPE0D1730BB036",12,0,0,0,0,0,0,"StandAloneCluster",0,"","",0,"",3,3,0,0,64,64,"","","","10.10.10.25","10.10.10.77",0,0,0,0,0,0,0,0,0,0,0,0,0,"",0,"",0,0,0,"","",2,"","","","","","","","",0,0,"","","","","","","","",0,0,0,"505","505","505",""
1,1,218476,18189616,1425443354,1,0,-485881334,"222","",0,16,4,-485881334,16388,4,20,0,0,0,0,0,0,"0","0",18189617,1,0,1896483338,"652","652","",0,0,4,1896483338,16390,4,20,0,0,0,0,0,0,"0","0",1425443361,1425443468,"652","ed4a4431-446c-4cd3-a093-0a9ed85483e5","Internal_PT","Internal_PT","Internal_PT","Internal_PT",107,"SEP84802D768E0F","SEPE0D1730A8CDB",12,0,0,0,0,0,0,"StandAloneCluster",0,"","",0,"",3,3,0,0,64,64,"","","","10.10.10.227","10.10.10.113",0,0,0,0,0,0,0,0,0,0,0,0,0,"",0,"",0,0,0,"","",2,"","","","","","","","",0,0,"","","","","","","","",0,0,0,"652","652","652",""

alt text

Tags (1)
0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...