topic Re: Field values with spaces in All Apps and Add-ons

Field values with spaces

tkwaller — Wed, 23 Apr 2014 18:11:41 GMT

Hello

I'm trying to use a field that has values that have spaces.

For example: errorMsg=Requested tickets could not be reserved

another example: errorMsg=System.ObjectDisposedException: The factory was disposed and can no longer be used. Object name: 'this'.

The problem is that the messages contain spaces. All of the messages are different in this field, some longer with less spaces and some shorter. When I do a stats count command on the errorMsg field but all I get is the first word of the string.

Any ideas on how I can correct this?

I also tried using the Field Extractor but alas no good.

Thank you!

Re: Field values with spaces

linu1988 — Wed, 23 Apr 2014 18:17:54 GMT

do you have the entire sentence always as the error message after errorMsg=?

Re: Field values with spaces

tkwaller — Wed, 23 Apr 2014 18:20:16 GMT

No sometimes it is something more simple as: errorMsg=Requested tickets could not be reserved

Re: Field values with spaces

tkwaller — Wed, 23 Apr 2014 18:49:15 GMT

but it is always more than one word

Re: Field values with spaces

linu1988 — Wed, 23 Apr 2014 18:50:05 GMT

i meant after = sign do you have the error message or do you get something else??

Re: Field values with spaces

tkwaller — Wed, 23 Apr 2014 18:51:41 GMT

yes after the = sign there is always a message like examples above. It is NEVER NULL. When I use the stats command I only get the first word of the message

Re: Field values with spaces

linu1988 — Wed, 23 Apr 2014 19:03:25 GMT

Well you could extract the value from the the event and then assign it to a new filed. Take a chance with the below one.

source...| rex field=_raw "errorMsg=(?P<Error>[\S\s]+)" |stats count by Error

Thanks

Re: Field values with spaces

tkwaller — Wed, 23 Apr 2014 19:24:45 GMT

Both of these seemed to be correct answers. The first solves inline and the second works great as an extraction. Thanks for the help guys, I greatly appreciate it!