topic Re: How can I trim a string after a new line? in Splunk Enterprise

How can I trim a string after a new line?

dsapergia — Thu, 25 Aug 2016 20:53:18 GMT

I have a search that returns events from an error log. I would like to do a timechart sorted by error Message.

However I only want to display the first line of the error message. I would like to turn this:

Message=Error approving item on orderdetail.aspx.
Exception: Thread was being aborted.
Stack Trace:
at System.Threading.Thread.AbortInternal()
at System.Threading.Thread.Abort(Object stateInfo)

into this:
Message=Error approving item on oderdetail.aspx.

How can I trim the text of the Message field after the new line?

Re: How can I trim a string after a new line?

somesoni2 — Thu, 25 Aug 2016 21:08:27 GMT

Try like this

your base search | rex field=error_message "^(?<error_message>[^\r\n]+)"

Re: How can I trim a string after a new line?

ChrisYang — Thu, 25 Aug 2016 21:28:42 GMT

Try this in your search:

| rex field=_raw "^Message=(?<TrimedMessage>[^\n]+\n)"

Then, you can display the the first line of the error message by "TrimedMessage" defined above.

Re: How can I trim a string after a new line?

dsapergia — Thu, 25 Aug 2016 21:42:00 GMT

When I do that and do timechart by TrimedMessage I only get NULL returned.

Re: How can I trim a string after a new line?

dsapergia — Thu, 25 Aug 2016 21:47:13 GMT

That does the trick! Thank you.

Incidentally, can you point me to some documentation about what the different variables mean in the rex expression? Or just a quick programming -> English translation?

I assume ? is the variable of the content of the error Message, and \r\n is a carriage return new line, but what do the ^ and + represent?

Re: How can I trim a string after a new line?

ChrisYang — Thu, 25 Aug 2016 22:34:28 GMT

| rex field=_raw "^Message=(?[^\r\n]+)"

Sorry, should be like this.

Or, you can try:
| rex field=_raw "^Message=(?.+)"