Regex isnt working for my search string

navd — Tue, 29 Sep 2020 20:02:21 GMT

I want to extract a field from the log event using regex .following is the sample log event , can someone tell me how to write rex for it .My rex isn't working ,it says mismatched ']'

java.util.concurrent.Exception: Code: Internal Server Error; Exception: com.rate.ps.execute.exception.Exception: { "message": "not upto date" }
... 11 lines omitted ...

I want to write rex for "Code: Internal Server Error; Exception: com.rate.ps.execute.exception.Exception: { "message": "not upto date" }"

|rex (?([a-zA-Z]\w+.)+\w*Exception\W+[^"]+\W:\W+[^"]+\W*)

Re: Regex isnt working for my search string

jodyfsu — Tue, 19 Jun 2018 20:25:22 GMT

Not real sure which part you are trying to capture, but here is what I came up with:

| rex "java\.util\.concurrent\.Exception\:\s(?<CODE>.[^\;]+)\;\sException\:(?<EXCEPTION>.[^\:]+)\:\s\{\s(?<MSG>.[^\}]+)"

Let me know if you need more.

topic Regex isnt working for my search string in Splunk Search

Regex isnt working for my search string

Re: Regex isnt working for my search string