topic Re: How to show all message from certain log via rex? in Splunk Search

How to show all message from certain log via rex?

ivana27 — Tue, 02 Mar 2021 07:47:51 GMT

Hi dear Splunkers,

i have log like this :

2021-02-11 14:47:51.167 [Error] ** Dummy User with dummyNumb:1111 Plate:AAAAA Country:Dummy paid dummy on DunnoOrder:2222222, but Dum sz: erere:45454545 not dispensed for Carouserl_Error !!!

And i would like to display everything after [Error] **.

I tried like this but i got error:

| rex "\[Error\]\s**\s(?<message>)"

Please help

Thank you

Re: How to show all message from certain log via rex?

ITWhisperer — Tue, 02 Mar 2021 07:52:57 GMT

| rex "\[Error\]\s\*\*\s(?<message>.*)"

Re: How to show all message from certain log via rex?

kamlesh_vaghela — Tue, 02 Mar 2021 07:54:44 GMT

@ivana27

Can you please try this?

| rex "\[Error\]\s\*\*\s(?<message>.*)"

Sample Search:

| makeresults | eval _raw="2021-02-11 14:47:51.167 [Error] ** Dummy User with dummyNumb:1111 Plate:AAAAA Country:Dummy paid dummy on DunnoOrder:2222222, but Dum sz: erere:45454545 not dispensed for Carouserl_Error !!!" | rex "\[Error\]\s\*\*\s(?<message>.*)"

Re: How to show all message from certain log via rex?

kamlesh_vaghela — Tue, 02 Mar 2021 07:55:27 GMT

oops.. late reply 🙂

Re: How to show all message from certain log via rex?

ivana27 — Tue, 02 Mar 2021 08:13:21 GMT

Thank you in any case 🙂

Do you know how to put messages from Error one after another and not in horizontal view?

@kamlesh_vaghela

Re: How to show all message from certain log via rex?

kamlesh_vaghela — Tue, 02 Mar 2021 08:19:38 GMT

Can you please share your expected sample output. So I can help you..

Re: How to show all message from certain log via rex?

ITWhisperer — Tue, 02 Mar 2021 08:22:52 GMT

What delimits the parts of the message you want to separate?

Re: How to show all message from certain log via rex?

ivana27 — Tue, 02 Mar 2021 08:34:54 GMT

Should be split by _time of log, should look like this

2021-02-12 00:35:20.820 [Error] ## sample1 bla bla bla
2021-02-12 00:35:20.836 [Information] sample2 bla bla bla
2021-02-12 00:35:30.731 [Information] sample3 bla bla bla
2021-02-12 00:35:31.429 [Information] sample4 bla bla bla
2021-02-12 00:35:31.506 [Error] ## sample5 bla bla bla
2021-02-12 00:35:31.519 [Error] ** sample6 bla bla bla

And now i have search like this which displays in same row:

index=pkg_prespvm host IN (*)
| dedup _raw
| transaction host startswith="[Information] STEP = Dummy" endswith="[Information] -- START TRANSACTION --"
| rex field=_raw "plate:(?<info>[^,]+)"
| rex "\[Error\]\s\*\*\s(?<message>.*)"
| rex "\[Error\]\s\##\sGet\sDuuno\sTransaction\s(?<tranok>.*)"
| rex "\[Error\]\s\CustNum:\s(?<customer>.*)"
| search "Get Transaction NOK --> Payment:OK"
| stats count by host _time tranok message customer info
| table _time host customer tranok message info