topic Re: Trying to rex for an event thread in Splunk Enterprise

Trying to rex for an event thread?

pranay04 — Wed, 10 Jun 2020 16:28:56 GMT

This is the Error Message in the log :

info [native] Creating Memory Dump upon ResourceExhausted Notification: unable to create new native thread

I am trying to rex for "info [native] Creating Memory Dump upon ResourceExhausted Notification" using syntax
rex "Creating Memory Dump upon '(?\w+)' Notification" and display in a dashboard but it does not work.

Anything wrong with it?

Re: Trying to rex for an event thread

anthonymelita — Fri, 29 Mar 2019 22:29:22 GMT

You have several things wrong. Note: I'm also a RegEx novice.
Replace spaces with \s
You didn't name an extracted field <>
If the extracted word will always be between "upon" and "Notification" you can shorten the rest.

| makeresults
| eval sentence="info [native] Creating Memory Dump upon ResourceExhausted Notification: unable to create new native thread"
| rex field=sentence "(upon\s)(?<extracted_thing>\w+)(\sNotification)"

Re: Trying to rex for an event thread

woodcock — Mon, 01 Apr 2019 04:48:45 GMT

Like this:

| makeresults 
| eval _raw="info [native] Creating Memory Dump upon ResourceExhausted Notification: unable to create new native thread"
| rex "^(?<msg>[^:]+)"