topic Re: I can't capture an unrecognized field with a space in Splunk Search

I can't capture an unrecognized field with a space

dbaker42 — Mon, 28 Sep 2020 13:31:43 GMT

I'm running the following command:
host=Computername AND EventCode=1309 | rename "Exception message" as Exception_message | dedup Application_Path | table Application_Path Exception_message

But it still won't recognize Exception message. If I expand the results, here is a snippet of the returned data:

Exception information: Exception type: HttpException Exception message: Server cannot set status after HTTP headers have been sent.

I'd like to create a table showing the Application Path and the Exception message, but I can't get it to recognize my field. Help! Thanks in advance.

Re: I can't capture an unrecognized field with a space

bmacias84 — Fri, 15 Mar 2013 18:18:18 GMT

I am assuming you already have a field extraction or transform for this sourcetype and all the fields you are referencing?

Re: I can't capture an unrecognized field with a space

alacercogitatus — Fri, 15 Mar 2013 18:22:12 GMT

Looks like this is a windows log file. Try this:

host=Computername EventCode=1309 | rex field=_raw "Exception message:(?<exception_message>[^\r\n]*)"| dedup Application_Path| table Application_Path exception_message

Re: I can't capture an unrecognized field with a space

dbaker42 — Fri, 15 Mar 2013 19:05:53 GMT

Brilliant! That worked perfectly. Thanks!

Re: I can't capture an unrecognized field with a space

alacercogitatus — Fri, 15 Mar 2013 19:08:33 GMT

Glad it worked for you, please accept the answer if it worked for you.