topic Regex Expression to find errors not matching in Splunk Search

Regex Expression to find errors not matching

sphiwee — Mon, 17 Aug 2020 18:50:20 GMT

Can someone show me what the regex expression for the below extract would be? & can you show me how you arrived to that conclusion, NB i have tried reg101 and Im still confused.

i have tried this expression

rex field=_raw "ERROR - (?<Error_Message>.+)"

2020-08-17 16:34:02,141 [68618-1397] ERROR NodePoolServlet - [urn:uuid:6144BCB27826B3BECC1597674752077153] Bot Manager can't find a free Bot to execute a robotic task. Please check that Bots with requested capabilties are alive using the Healtcheck API and the Bot Source size in Control Tower is equal to the number of available Bots.

Re: Regex Expression to find errors not matching

impurush — Mon, 17 Aug 2020 19:12:25 GMT

@sphiwee
If I understand correctly, you need the error details in a keyword after the ERROR message.

You can use the below regex format to achieve that.

<your query>|rex field=_raw "ERROR\s(?<Error_Message>.+)"

Re: Regex Expression to find errors not matching

thambisetty — Mon, 17 Aug 2020 19:18:15 GMT

The regex you posted extracted nothing from the event posted.

rex field=_raw "ERROR - (?<Error_Message>.+)" to explain your regex.

field=_raw - indicates Splunk to look in _raw field for extraction ERROR - (?<Error_Message>.+)

The extraction "ERROR - (?<Error_Message>.+)" - first identify ERROR - and value will be extracted after ERROR - till end of line and the value will be kept in Error_Message field.

Find below video useful

Regular Expressions in Splunk

Re: Regex Expression to find errors not matching

sphiwee — Mon, 17 Aug 2020 21:15:44 GMT

no only need this part "ERROR NodePoolServlet -"

Re: Regex Expression to find errors not matching

impurush — Mon, 17 Aug 2020 21:27:03 GMT

Hi @sphiwee

Use the below one

<your query>|rex field=_raw "ERROR\s(?<Error_Message>.+)\-"

Re: Regex Expression to find errors not matching

to4kawa — Mon, 17 Aug 2020 21:33:20 GMT

rex field=_raw "ERROR - (?<Error_Message>.+)" is match

ERROR - <<SOMETHING>>

2020-08-17 16:34:02,141 [68618-1397] ERROR NodePoolServlet - [urn:uuid:6144BCB27826B3BECC1597674752077153] Bot Manager can't find a free Bot to execute a robotic task. Please check that Bots with requested capabilties are alive using the Healtcheck API and the Bot Source size in Control Tower is equal to the number of available Bots.

your log does not have -(hyphen) after ERROR. so this can't match.

"ERROR\s(?<Error_Message>\S+)"