I'm working with SugarCRM and Splunk.
In SugarCRM log, several time in the middle of the message I have an UUID that breaks the message.
My goal is to create a regular expression that extract a value using a capture group. This capture group is used inside a dashboard in Splunk that aggregates errors that should not have the UUID inside, but all the other parts of the message. The extraction of the message is also terminated by some special characters.
Let me make an example:
Message 1: Job 12345678-1234-1234-1234-123456789012 (JobName1) failed
Message 2: Could not find parent record 12345678-1234-1234-1234-123456789012 in module: mymodule
Message 3: Some text 12345678-1234-1234-1234-123456789012 with specific value=1234
My specific message enders are - , = , {
The UUID should or should not be contained inside the message
Message 4: Another error message without id but with value=12344
What I like to have, from Splunk, is a capture group called error_msg that should contain, for the previous examples, the text:
error_msg 1: Job (JobName1) failed
error_msg 2: Could not find parent record in module: mymodule
error_msg 3: Some text with specific value
error_msg 4: Another error message without id but with value
So, extraction of text without the UUID, ended when an escape character -, =, { is found.
I was trying to do, without any success, something like this:
(?P<error_msg>(?:\w{8}-\w{4}-\w{4}-\w{4}-\w{12})([^-|=|-|\{]+))
Can anyone help me about that?
Thanks a lot for your time :)
Instead of trying to capture everything but a [possibly-present] UUID, just remove it instead (and then remove extra spaces):
index=ndx sourcetype=srctp message=*
| eval error_msg=replace(message,"\w{8}-\w{4}-\w{4}-\w{4}-\w{12}","")
| eval error_msg=replace(error_msg,"\s+"," ")
If you know that the UUID is always contained inside whitespace, you could make the first replace() more efficient thusly:
| eval error_msg=replace(message,"\s\w{8}-\w{4}-\w{4}-\w{4}-\w{12}\s","")