topic Why am I unable to REX out a subset of a field? in Splunk Search

Why am I unable to REX out a subset of a field?

arist0telis — Wed, 16 Mar 2022 15:10:13 GMT

I've got an alert I put together and am trying to REX multiple pieces of it out to their own columns. This is against the Splunk internal logging. I had no problem pulling errorCode since it has a clearly defined field-within-a-field, but I'm not able to pull a subset string of another part of the message

Query
index=_internal sourcetype=sfdc:object:log log_level=ERROR OR log_level=WARNING
| rex "\"errorCode\":\"(?<errorCode>[^\s]+)\""
| stats count(stanza_name) by stanza_name, log_level, errorCode, message

I've got the message at the end just to give me the query error, but what I'd like to do is REX that also like I did to get the errorCode as its own column. Below is a sample message, with the part in bold what I'd like to rex out to its own column. I can't find an example of doing that where there isn't a clear delineation within the message like "errorCode":"<error>"

[{"message":"\nFoo,Bar,FooBar,FooBar2\n ^\nERROR at Row:1:Column:232\nNo such column 'FooBar2' on entity 'MyAwesomeObject'. If you are attempting to use a custom field, be sure to append the '__c' after the custom field name. Please reference your WSDL or the describe call for the appropriate names.","errorCode":"INVALID_FIELD"}]

Re: Unable to REX out a subset of a field

richgalloway — Tue, 15 Mar 2022 20:27:50 GMT

Assuming the desired text always follows "ERROR at Row:*:Column:*" and that "\n" are literal characters then this should do it. If these are not valid assumptions then please clarify the requirements.

index=_internal sourcetype=sfdc:object:log log_level=ERROR OR log_level=WARNING | rex "ERROR at Row:\d+:Column:\d+\\n(?<message>[^\.]+)" | rex "\"errorCode\":\"(?<errorCode>[^\s]+)\"" | stats count(stanza_name) by stanza_name, log_level, errorCode, message

Re: Unable to REX out a subset of a field

arist0telis — Wed, 16 Mar 2022 15:07:34 GMT

Doesn't look like that did it. part of the problem is the added REX is using the protected name message, which is also the name of the entire field. When you add message to the stats at the end it does the same thing I had above, it just outputs the entire message without REXing out the part I care about.

And yes, those \n are literals. I did a copy and paste of the exact flat text.

I changed the query to remove the protected names of the fields, "No results found" when I include that new REX trying to pull out the error message.

index=_internal sourcetype=sfdc:object:log log_level=ERROR OR log_level=WARNING
| rex "ERROR at Row:\d+:Column:\d+\\n(?<msg>[^\.]+)"
| rex "\"errorCode\":\"(?<err>[^\s]+)\""
| stats count(stanza_name) by stanza_name, log_level, err, msg

If you cut off the msg at the end, I at least get my errorCode column err back clean so that part works, it's just the new REX still isn't finding and capturing the message.

Re: Unable to REX out a subset of a field

ITWhisperer — Wed, 16 Mar 2022 15:24:53 GMT

Missing a couple of backslashes

| rex "ERROR at Row:\d+:Column:\d+\\\\n(?<msg>[^\.]+)"