topic Re: How to extract a filed which is in 4th line in log | Field Extraction in Splunk Search

How to extract a filed which is in 4th line in log | Field Extraction

ksidkumar — Fri, 04 Feb 2022 06:18:54 GMT

I a trying to Extract the exception Name which is at the 4th line in log generated as below -

<CS-1>2022-02-03T14:58:21.128+0100 ERROR org.flowable.job.service.impl.asyncexecutor.DefaultAsyncRunnableExecutionExceptionHandler 77037 DefaultAsyncRunnableExecutionExceptionHandler.java:44 -
[{user=system}]
- Job JOB-2d21fa4f-84f8-11ec-9094-02425ecfb8fb failed
org.flowable.common.engine.api.FlowableOptimisticLockingException: JobEntity [id=JOB-2d21fa4f-84f8-11ec-9094-02425ecfb8fb] was updated by another transaction concurrently
at org.flowable.common.engine.impl.db.DbSqlSession.flushDeleteEntities(DbSqlSession.java:643) ~[flowable-engine-common-6.6.0.17.jar!/:6.6.0.17]

I want to have the filed extraction of the Exception Name which is highlighted above in blue. - its position is 4th line and till the colon(:)

I am trying to use this which does not work in splunk field extraction regex-
^(.*\n){3}(?P<test_work_error>.+Exception:)

Please advise. Thanks in advance

Re: How to extract a filed which is in 4th line in log | Field Extraction

PickleRick — Fri, 04 Feb 2022 06:30:36 GMT

Are you sure it's on the fourth line? Pasting here seems to have massacred your event. Anyway, in such case it's usually easier to anchor to some known "static" part of message.

Job\s(?<JobID>\S+)\sfailed\s(?<exception>\S+):

Re: How to extract a filed which is in 4th line in log | Field Extraction

ksidkumar — Fri, 04 Feb 2022 06:53:29 GMT

Hi @PickleRick

Yes its on the 4th line..

Main issue is that we really don't have any static filed to track like u used JobId.
only i know is the 4th line till the word Exception: is encountered.

what i was trying is - ^(.*\n){3}(?P<test_work_error>.+Exception:)
It works fine in any regex environment but not in Splunk filed extraction

Re: How to extract a filed which is in 4th line in log | Field Extraction

PickleRick — Fri, 04 Feb 2022 07:44:41 GMT

If your events really get split properly and you indeed have multiline events. And you want the particular line, you should fiddle with the multiline regex modifiers (m and s) and line ends matching modifiers (*LF *CR *ANY and so on). I'm not sure which are on or off by default.

Re: How to extract a filed which is in 4th line in log | Field Extraction

johnhuang — Fri, 04 Feb 2022 08:08:07 GMT

failed\s+(?<test_work_error>[\w\.]*Exception)\: