topic Case insensitive search in rex in Splunk Search

Case insensitive search in rex

Naren26 — Wed, 21 Mar 2018 17:46:12 GMT

I am having a field such as Exception: NullReferenceException. And sometimes, EXCEPTION:NullReferenceExcpetion.

I need to capture the exception type with single rex command. I used the following rex, but it is not working:

rex "(?!)Exception:(?<ErrorType>.*)"

What am I doing wrong here? Is it possible to achieve? Kindly advice.

tiagofbmm — Wed, 21 Mar 2018 17:51:43 GMT

Hey

Here is your regex | rex field=t "(?i)Exception(?<lalal>.*)"

Try it in this generic example please:

| makeresults 
| eval t="Exception_asdasd" | append [ | makeresults | eval t="EXCEPTION_asdasd"]
| rex field=t "(?i)Exception(?<lalal>.*)"

mayurr98 — Thu, 22 Mar 2018 03:26:51 GMT

hey @Naren26
I think you have mistakenly written ! instead of i.
Your regex is correct just change (?!) with (?i)

So your regex would be

rex "(?i)Exception:(?<ErrorType>.*)"

let me know if this helps!

Naren26 — Thu, 22 Mar 2018 04:59:36 GMT

Oh my!! Such a silly mistake. Thanks for picking it up.