Splunk - check logs that are equal to any string I provide-CodePudding

I want to capture only the logs that hold the values of "Zero tolerance", "bolt from the blue", "A change is as good as a rest" inside. I've tried with this but it doesn't work it only captures the first one. /description=(?Zero tolerance | bolt from the blue | A change is as good as a rest)

Have in mind that the strings to check needs to be provided by me.

  code = random05, description=bird in the hand is worth two in the bush, level=5
  code = random02, description=bolt from the blue, level=8
  code = random09, description=bunch of fives, level=3
  code = random05, description=A chain is only as strong as its weakest link, level=0
  code = random08, description=A change is as good as a rest, level=3```

There are more logs but they are not showing.

CodePudding user response：

It looks like you want to match anything after description that contains one of the strings you specified. You can then use

description=(?<des>.*(?:Zero tolerance|bolt from the blue|A change is as good as a rest).*)

So, here, "des" group will match any zero or more chars other than line break chars as many as possible, then one of the specified strings (note the spaces around | are removed) and then again any zero or more chars other than line break chars as many as possible.

If you need to limit the match by the first comma, replace . with [^,].