topic Re: extract errorcode in Splunk Search

extract errorcode

indeed_2000 — Wed, 27 Oct 2021 06:14:52 GMT

Here is th e log:

2021-10-26 08:17:19,117 WARN AbCD-App2-0000 [SqlExceptionHelper] SQL Error: -268, SQLState: 23000
2021-10-26 08:01:47,674 WARN CUS.AbCD-APP2-0000000 [SqlExceptionHelper] SQL Error: -100, SQLState: IX000

expected output:

Error Status

268 23000

100 IX000

Thanks

Re: extract errorcode

yuanliu — Wed, 27 Oct 2021 06:33:40 GMT

Rex should work:

<base search> | rex "SQL Error: -(?<Error>]\d+), SQLState: (?<Status>.+)" | table Error Status

Re: extract errorcode

indeed_2000 — Wed, 27 Oct 2021 06:52:29 GMT

not work

Re: extract errorcode

indeed_2000 — Wed, 27 Oct 2021 11:28:37 GMT

after several try, find correct rex:

| rex "SQL\sError\:\s\-(?<Error>\d+)" | rex "\:\s(?<Status>\w+)"