topic rex extract first string in Splunk Search

rex extract first string

indeed_2000 — Mon, 04 Oct 2021 10:31:00 GMT

How can I extract first occured this "User ABC123 invalid" with rex?

Here is the log:

2021-10-03 13:26:44,441 ERROR [APP] User ABC123 invalid: javax.security.auth.login.LoginException: User ABC123 invalid

Thanks,

ITWhisperer — Mon, 04 Oct 2021 10:44:30 GMT

| rex "\]\s(?<error>[^:]+):"

gcusello — Mon, 04 Oct 2021 10:44:37 GMT

if your want to extract the message after "LoginException", you could use the following regex:

| rex "LoginException:\s+(?<message>.*)"

Ciao.

Giuseppe

ITWhisperer — Mon, 04 Oct 2021 11:31:47 GMT

Doesn't this give the second occurrence not the first?