topic Re: can't extract the field, below error shows up, in Splunk Search

can't extract the field, below error shows up,

simranrathi — Tue, 29 Sep 2020 19:32:56 GMT

Argument 'value' contains invalid character : ^[\d+;\d+\w+\s+\d+-\d+-\d+\s+\d+:\d+:\d+,\d+\s+[\w+::\w+.\w+.\w+.\w+.\w+.\w+.\w+]\s+[][][\w+\d+][][](\w+)\s+[\w+]\s+\w+\s+\w+\s+\d+\s+\w+\s+[\w+.\w+.\w+.\w+:\s+\w+\s+\w+\s+\w+\s+\w+[\w+:\d+,(?P[^,]+)

I'm trying to run this query to extract fields
index=tomcat (java.sql.SQLException: ORA-12899: value too large for column "NLHYP_USER"."PRODUCTSLP"."P_WASHCARE")
| rex field=message_text "itemPK:\s(?[^\,]+)" | rex field=message_text "langPK:\s(?[^\,]+)"

This field has to be extracted::

[itemPK:8977222991873,langPK:8796093120544,

Re: can't extract the field, below error shows up,

mayurr98 — Wed, 16 May 2018 05:32:03 GMT

Try this run anywhere search

| makeresults 
| eval message_text="[itemPK:8977222991873,langPK:8796093120544," 
| rex field=message_text "itemPK:(?<itemPK>[^\,]+)\,langPK:(?<langPK>[^\,]+)"

In your environment you should try

index=tomcat (java.sql.SQLException: ORA-12899: value too large for column "NLHYP_USER"."PRODUCTSLP"."P_WASHCARE") 
| rex field=message_text  "itemPK:(?<itemPK>[^\,]+)\,langPK:(?<langPK>[^\,]+)"

let me know if this helps!

Re: can't extract the field, below error shows up,

niketn — Wed, 16 May 2018 05:43:23 GMT

@simranrathi while posting code/data use the code button on Splunk Answers i.e. 101010 or Shortcut Ctrl+K so that special characters do not escape.

Re: can't extract the field, below error shows up,

simranrathi — Wed, 16 May 2018 07:06:35 GMT

I've tried this
but it is only showing me the results for this particular event
I want more of a generic search to extract all the events' fields

Re: can't extract the field, below error shows up,

mayurr98 — Wed, 16 May 2018 09:59:48 GMT

for that, you would need to give me sample data of all such events. No one can give you regex without seeing at the events. Please provide all sample different types of events from which you want to extract these fields.