Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to edit my rex statement to ignore line breaks to extract the entire value for a certain field?

$
0
0
Hello, I have an event like this: 2016-03-04 00:02:05,546 DEBUG [net.ussouth.aps.shared.util.SysLogUtil] fastcardActdbservice8a848b8d531f68940153400111f417ae20160304000206;0987789000000000=0987789000000000=0987789000000000076750046688405.0Toys R Us05927 TOYS05927100FCMS08759149USD590200 08759105927 TOYS.05927100537465658707779818a848b8d531f68940153400111f417aefalse and I'm using this regex to get some fields from it: | rex "(?(\d{4}-\d{2}-\d{2} \d{2}\:\d{2}\:\d{2}\,\d{3})) (?DEBUG|INFO|WARN|ERROR) (?\[.*\]) (?.*)" | table timestamp, loglevel, origin, content I can get all the fields ok except for **content** that is stopping when it finds a linebreak in the text. How can I make it get all the remaining text and set it in the (content) field? Regards!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>