topic Re: How to extract ErrorCode from log messages using regex? in Splunk Enterprise

How to extract ErrorCode from log messages using regex?

dezmadi — Fri, 01 Apr 2022 15:43:01 GMT

I have messages like below in logs, I want to extract ErrorCode from Those messages, Here ErrorCode is CIS-46031

However there could be space right after ErrorCode or after ErrorCode:

msg: ErrorCode:CIS-46031,ErrorMessage:Some unknown error occurred in outage daemon request. Please check.,Error occurred in CIS domain events outage processing.

msg: ErrorCode : CIS-46032,ErrorMessage:Some unknown error occurred in outage daemon request.

msg: ErrorCode :CIS-46033, ErrorMessage:Some unknown error occurred in outage daemon request.

How can we do the same in Splunk

Re: regex

ITWhisperer — Fri, 01 Apr 2022 11:47:31 GMT

| rex "ErrorCode\s*:\s*(?<errorcode>[^,]+),"

Re: regex

dezmadi — Fri, 01 Apr 2022 12:29:19 GMT

Thanks @ITWhisperer , It worked

Re: regex

dezmadi — Mon, 04 Apr 2022 06:38:57 GMT

Thanks, it worked, however in visulalization, it prints as NULL if there's a space in between

For instance it prints NULL for ErrorCode: CIS-53030

However if it's ErrorCode: CIS-53031, it prints correct value as ErrorCode: CIS-53031

Re: regex

ITWhisperer — Mon, 04 Apr 2022 07:34:10 GMT

| rex "ErrorCode\s*:\s*(?<errorcode>[^\s,]+),"

Re: How to extract ErrorCode from log messages using regex?

dezmadi — Mon, 04 Apr 2022 08:25:40 GMT

Thanks, but I am still getting it as NULL, I have pasted it below

Below is the message (Here there is a space between ErrorCode: and CIS-53030)

msg: ErrorCode: CIS-53030 Events cannot be processed

Re: How to extract ErrorCode from log messages using regex?

ITWhisperer — Mon, 04 Apr 2022 08:34:22 GMT

If ErrorCode: doesn't exist in your events, you will get NULL. Are you expecting all events to have ErrorCode in? If so, can you share some of the events which are not matching the rex?

| rex "ErrorCode\s*:\s*(?<errorcode>[^\s,]+)," | where isnull(errorcode)

Re: How to extract ErrorCode from log messages using regex?

dezmadi — Mon, 04 Apr 2022 08:41:12 GMT

ErrorCode exist in the event, however if there is space, it's returning as null in visualisation, For instance, in below event, we have ErrorCode: CIS-53030 (Here there is space between ErrorCode: and CIS-53030), it's showing as NULL

msg: ErrorCode: CIS-53030 Events cannot be processed as WFM is not provisioned for WFM ID

Re: How to extract ErrorCode from log messages using regex?

ITWhisperer — Mon, 04 Apr 2022 08:44:09 GMT

Try it without the tail anchor ","

| rex "ErrorCode\s*:\s*(?<errorcode>[^\s,]+)"

Re: How to extract ErrorCode from log messages using regex?

dezmadi — Mon, 04 Apr 2022 09:00:02 GMT

Thanks a lot, it worked