topic Re: regex to capture first two lines following the word 'ERROR' in Splunk Enterprise https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-regex-to-capture-first-two-lines-following-the/m-p/599057#M12634 <P>What have you tried so far?&nbsp; How did those efforts fail to meet expectations?<BR /><SPAN>Are the lines all in a single event or in multiple events?</SPAN></P> Tue, 24 May 2022 12:31:14 GMT richgalloway 2022-05-24T12:31:14Z How to create a regex to capture first two lines following the word 'ERROR'? https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-regex-to-capture-first-two-lines-following-the/m-p/599055#M12633 <P>Hi,<BR /><BR />I need to capture first two line following the word 'ERROR' from the log file.</P> <P>Example 1:<BR />2022-05-20 11:36:22,393 ERROR [com.https.custom.integration.Integration](WFA:346899 - 5678976 triExecute:671116263 IE=671116263) com.https.platform.smartobject.dataaccess.SmartObjectNotFoundException: No Smart Object with id '-1' exists<BR />com.https.platform.smartobject.dataaccess.SmartObjectNotFoundException: No Smart Object with id '-1' exists<BR />at com.https.platform.smartobject.dataaccess.SmartObjectDaoImpl.read(SmartObjectDaoImpl.java:131)<BR /><BR />Example 2:<BR />2022-05-20 11:36:36,804 ERROR [com.https.ws.https](Thread-789) com.https.ws.errors.AccessException: User does not have access to create records in this GUI. [User:- , GUI: triIntegrationInstance]<BR />com.https.ws.errors.AccessException: User does not have access to create records in this GUI. [User: ahmuy, wasim- kb4567, GUI: triIntegrationInstance]<BR />at com.https.ws.utils.Validator.validateCreateAccess(Validator.java:588)<BR />at com.https.ws.WSProcessThread.processRecord(WSProcessThread.java:258)<BR />at com.https.ws.WSProcessThread.run(WSProcessThread.java:147)<BR /><BR />Please help me with regex.<BR /><BR /><BR /><BR /></P> Tue, 24 May 2022 15:27:25 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-regex-to-capture-first-two-lines-following-the/m-p/599055#M12633 Ashwini008 2022-05-24T15:27:25Z Re: regex to capture first two lines following the word 'ERROR' https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-regex-to-capture-first-two-lines-following-the/m-p/599057#M12634 <P>What have you tried so far?&nbsp; How did those efforts fail to meet expectations?<BR /><SPAN>Are the lines all in a single event or in multiple events?</SPAN></P> Tue, 24 May 2022 12:31:14 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-regex-to-capture-first-two-lines-following-the/m-p/599057#M12634 richgalloway 2022-05-24T12:31:14Z Re: regex to capture first two lines following the word 'ERROR' https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-regex-to-capture-first-two-lines-following-the/m-p/599206#M12669 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;It is single event.<BR /><BR /><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;Can you please help here</P> Wed, 25 May 2022 06:15:50 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-regex-to-capture-first-two-lines-following-the/m-p/599206#M12669 Ashwini008 2022-05-25T06:15:50Z Re: regex to capture first two lines following the word 'ERROR' https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-regex-to-capture-first-two-lines-following-the/m-p/599214#M12672 <LI-CODE lang="markup">| rex "ERROR (?&lt;error&gt;.*\n.*)"</LI-CODE> Wed, 25 May 2022 06:25:06 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-regex-to-capture-first-two-lines-following-the/m-p/599214#M12672 ITWhisperer 2022-05-25T06:25:06Z