<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: need to extract these errors from our logs in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/need-to-extract-these-errors-from-our-logs/m-p/525067#M35607</link>
    <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/223364"&gt;@sphiwee&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;when you say "&lt;SPAN&gt;Can i get the following words", are you meaning that you want to filter events and find the ones containing these strings or put these values in a field?&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;if you want only to filter events and find the ones containing these strings, you can run a simple search like this:&lt;/SPAN&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;your_search ("[ERROR] org.openqa.selenium.TimeoutException" OR "Frzzz Logs Business Process v2.0.7 (TTTxLogAttachment)" OR "[INFO]" OR "[DEBUG]")
| ...&lt;/LI-CODE&gt;&lt;P&gt;If the strings to search are many, you could put them in a lookup (called e.g. patterns.csv) containing one column called e.g. "pattern" and run a search like this:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;your_search [ | inputlookup patterns.csv | rename pattern AS query | fields query ]
| ...&lt;/LI-CODE&gt;&lt;P&gt;Ifg instead you want to put these strings in a field you have to create a regex for each string, something like this:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;your_search 
| rex "(?&amp;lt;pattern&amp;gt;(\[ERROR\] org\.openqa\.selenium\.TimeoutException)|(Frzzz Logs Business Process v2\.0\.7 \(TTTxLogAttachment\))|(\[INFO\])|(\[DEBUG\]))"
| search pattern=*
| table _time pattern&lt;/LI-CODE&gt;&lt;P&gt;Ciao.&lt;/P&gt;&lt;P&gt;Giuseppe&lt;/P&gt;</description>
    <pubDate>Fri, 16 Oct 2020 14:08:22 GMT</pubDate>
    <dc:creator>gcusello</dc:creator>
    <dc:date>2020-10-16T14:08:22Z</dc:date>
    <item>
      <title>need to extract these errors from our logs</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/need-to-extract-these-errors-from-our-logs/m-p/525064#M35606</link>
      <description>&lt;P&gt;Can i get the following words that are&amp;nbsp;&lt;STRONG&gt;bold&lt;/STRONG&gt; extracted&lt;/P&gt;&lt;P&gt;1.&amp;nbsp;&amp;nbsp;&lt;STRONG&gt;[ERROR] org.openqa.selenium.TimeoutException&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;BR /&gt;2020-10-16 13:11:42 [machine-run-555555-hit-1087581-step-555] TSXLogAttachmentRobot &lt;STRONG&gt;[ERROR] org.openqa.selenium.TimeoutException&lt;/STRONG&gt;: Expected condition failed: waiting for number of open windows to be 2 (tried for 30 second(s) with 500 MILLISECONDS interval)&lt;/P&gt;&lt;P&gt;2. &lt;SPAN class="t"&gt;&lt;STRONG&gt;Frzzz&lt;/STRONG&gt;&lt;/SPAN&gt;&lt;STRONG&gt;&amp;nbsp;&lt;SPAN class="t"&gt;Logs&lt;/SPAN&gt; &lt;SPAN class="t"&gt;Business&lt;/SPAN&gt; &lt;SPAN class="t"&gt;Process&lt;/SPAN&gt; &lt;SPAN class="t"&gt;v2.0.7&lt;/SPAN&gt; (TTT&lt;SPAN class="t"&gt;xLogAttachment&lt;/SPAN&gt;&lt;/STRONG&gt;&lt;SPAN&gt;&lt;STRONG&gt;)&lt;/STRONG&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;BR /&gt;&lt;SPAN class="t"&gt;Capabilities&lt;/SPAN&gt;&lt;SPAN&gt; [{&lt;/SPAN&gt;&lt;SPAN class="t"&gt;capabilityNodeId=&lt;A href="http://127.0.0.1:5000" target="_blank" rel="noopener"&gt;http://127.0.0.1:5000&lt;/A&gt;&lt;/SPAN&gt;&lt;SPAN&gt;, &lt;/SPAN&gt;&lt;SPAN class="t"&gt;extra.executor.id=&lt;/SPAN&gt;&lt;SPAN&gt;{&lt;/SPAN&gt;&lt;SPAN class="t"&gt;&lt;SPAN class="t h"&gt;run.name&lt;/SPAN&gt;=&lt;/SPAN&gt;&lt;SPAN&gt;[&lt;/SPAN&gt;&lt;SPAN class="t"&gt;Digiminds&lt;/SPAN&gt; &lt;SPAN class="t"&gt;-&lt;/SPAN&gt; &lt;SPAN class="t"&gt;FraudLogs&lt;/SPAN&gt;&lt;SPAN&gt;] &lt;/SPAN&gt;&lt;SPAN class="t"&gt;Part&lt;/SPAN&gt; &lt;SPAN class="t"&gt;2&lt;/SPAN&gt; &lt;SPAN class="t"&gt;v.2.0.7&lt;/SPAN&gt;&lt;SPAN&gt;, &lt;/SPAN&gt;&lt;SPAN class="t"&gt;task.uuid=c65b1153-bd19-4c32-b186-26ae21ca237b&lt;/SPAN&gt;&lt;SPAN&gt;, &lt;/SPAN&gt;&lt;SPAN class="t"&gt;task.name=&lt;STRONG&gt;Frzzz&lt;/STRONG&gt;&lt;/SPAN&gt;&lt;STRONG&gt;&amp;nbsp;&lt;SPAN class="t"&gt;Logs&lt;/SPAN&gt; &lt;SPAN class="t"&gt;Business&lt;/SPAN&gt; &lt;SPAN class="t"&gt;Process&lt;/SPAN&gt; &lt;SPAN class="t"&gt;v2.0.7&lt;/SPAN&gt; (TTT&lt;SPAN class="t"&gt;xLogAttachment&lt;/SPAN&gt;&lt;/STRONG&gt;&lt;SPAN&gt;&lt;STRONG&gt;)&lt;/STRONG&gt;,&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;3. the word &lt;STRONG&gt;[INFO]&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN class="t"&gt;2020-10-16&lt;/SPAN&gt; &lt;SPAN class="t"&gt;15:37:17&lt;/SPAN&gt;&lt;SPAN&gt; [&lt;/SPAN&gt;&lt;SPAN class="t"&gt;bp-&lt;/SPAN&gt;&lt;SPAN&gt;[&lt;/SPAN&gt;&lt;SPAN class="t"&gt;25cf86e3&lt;/SPAN&gt;&lt;SPAN&gt;]&lt;/SPAN&gt;&lt;SPAN class="t"&gt;-completeMachineRun-569576&lt;/SPAN&gt;&lt;SPAN&gt;] &lt;/SPAN&gt;&lt;SPAN class="t"&gt;HitService&lt;/SPAN&gt;&lt;STRONG&gt; &lt;SPAN class="t a"&gt;[&lt;SPAN class="t"&gt;INFO&lt;/SPAN&gt;]&lt;/SPAN&gt;&lt;/STRONG&gt; &lt;SPAN class="t"&gt;Snapshot&lt;/SPAN&gt; &lt;SPAN class="t"&gt;creation&lt;/SPAN&gt; &lt;SPAN class="t"&gt;for&lt;/SPAN&gt; &lt;SPAN class="t"&gt;Run:&lt;/SPAN&gt; &lt;SPAN class="t"&gt;id=569576&lt;/SPAN&gt;&lt;SPAN&gt;, &lt;/SPAN&gt;&lt;SPAN class="t"&gt;uuid=d60be317-fcaa-4d96-89f5-8144216bdd28&lt;/SPAN&gt; &lt;SPAN class="t"&gt;name=Debt&lt;/SPAN&gt; &lt;SPAN class="t"&gt;Structure&lt;/SPAN&gt; &lt;SPAN class="t"&gt;Project&lt;/SPAN&gt; &lt;SPAN class="t"&gt;&lt;SPAN class="t h"&gt;v2&lt;/SPAN&gt;.0.22&lt;/SPAN&gt;&lt;SPAN&gt; (&lt;/SPAN&gt;&lt;SPAN class="t"&gt;MainframeCpsRobot&lt;/SPAN&gt;&lt;SPAN&gt;) {&lt;/SPAN&gt;&lt;SPAN class="t"&gt;size:1&lt;/SPAN&gt;&lt;SPAN&gt;, &lt;/SPAN&gt;&lt;SPAN class="t"&gt;status:COMPLETED&lt;/SPAN&gt;&lt;SPAN&gt;, &lt;/SPAN&gt;&lt;SPAN class="t"&gt;rootRun:25cf86e3-2b33-4ee6-85b0-a303cb612efc&lt;/SPAN&gt;&lt;SPAN&gt;, &lt;/SPAN&gt;&lt;SPAN class="t"&gt;data:&lt;/SPAN&gt;&lt;SPAN&gt;} &lt;/SPAN&gt;&lt;SPAN class="t"&gt;was&lt;/SPAN&gt; &lt;SPAN class="t"&gt;skipped&lt;/SPAN&gt; &lt;SPAN class="t"&gt;due&lt;/SPAN&gt; &lt;SPAN class="t"&gt;to&lt;/SPAN&gt; &lt;SPAN class="t"&gt;snapshot&lt;/SPAN&gt; &lt;SPAN class="t"&gt;generation&lt;/SPAN&gt; &lt;SPAN class="t"&gt;preferences&lt;/SPAN&gt; &lt;SPAN class="t"&gt;or&lt;/SPAN&gt; &lt;SPAN class="t"&gt;it&lt;/SPAN&gt; &lt;SPAN class="t"&gt;is&lt;/SPAN&gt; &lt;SPAN class="t"&gt;final&lt;/SPAN&gt; &lt;SPAN class="t"&gt;step&lt;BR /&gt;&lt;BR /&gt;4. the word [DEBUG]&lt;BR /&gt;&lt;BR /&gt;2020-10-16 15:28:00&lt;SPAN&gt; [T&lt;/SPAN&gt;TTTTTTTTT_Worker-44&lt;SPAN&gt;] &lt;/SPAN&gt;HitService&lt;STRONG&gt; &lt;SPAN class="t a"&gt;[DEBUG]&lt;/SPAN&gt;&lt;/STRONG&gt; Step description for run &lt;SPAN class="t h"&gt;20cda5dd&lt;/SPAN&gt;-3081-4660-be90-f2103c52a716 from campaign c701b1b7-96f3-46b6-a408-61b18d066e45 is null&lt;BR /&gt;&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 16 Oct 2020 13:45:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/need-to-extract-these-errors-from-our-logs/m-p/525064#M35606</guid>
      <dc:creator>sphiwee</dc:creator>
      <dc:date>2020-10-16T13:45:14Z</dc:date>
    </item>
    <item>
      <title>Re: need to extract these errors from our logs</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/need-to-extract-these-errors-from-our-logs/m-p/525067#M35607</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/223364"&gt;@sphiwee&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;when you say "&lt;SPAN&gt;Can i get the following words", are you meaning that you want to filter events and find the ones containing these strings or put these values in a field?&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;if you want only to filter events and find the ones containing these strings, you can run a simple search like this:&lt;/SPAN&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;your_search ("[ERROR] org.openqa.selenium.TimeoutException" OR "Frzzz Logs Business Process v2.0.7 (TTTxLogAttachment)" OR "[INFO]" OR "[DEBUG]")
| ...&lt;/LI-CODE&gt;&lt;P&gt;If the strings to search are many, you could put them in a lookup (called e.g. patterns.csv) containing one column called e.g. "pattern" and run a search like this:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;your_search [ | inputlookup patterns.csv | rename pattern AS query | fields query ]
| ...&lt;/LI-CODE&gt;&lt;P&gt;Ifg instead you want to put these strings in a field you have to create a regex for each string, something like this:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;your_search 
| rex "(?&amp;lt;pattern&amp;gt;(\[ERROR\] org\.openqa\.selenium\.TimeoutException)|(Frzzz Logs Business Process v2\.0\.7 \(TTTxLogAttachment\))|(\[INFO\])|(\[DEBUG\]))"
| search pattern=*
| table _time pattern&lt;/LI-CODE&gt;&lt;P&gt;Ciao.&lt;/P&gt;&lt;P&gt;Giuseppe&lt;/P&gt;</description>
      <pubDate>Fri, 16 Oct 2020 14:08:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/need-to-extract-these-errors-from-our-logs/m-p/525067#M35607</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2020-10-16T14:08:22Z</dc:date>
    </item>
    <item>
      <title>Re: need to extract these errors from our logs</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/need-to-extract-these-errors-from-our-logs/m-p/525080#M35611</link>
      <description>&lt;P&gt;Yes, i'm struggling with writing regular expressions for those words&lt;/P&gt;</description>
      <pubDate>Fri, 16 Oct 2020 15:18:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/need-to-extract-these-errors-from-our-logs/m-p/525080#M35611</guid>
      <dc:creator>sphiwee</dc:creator>
      <dc:date>2020-10-16T15:18:11Z</dc:date>
    </item>
  </channel>
</rss>

