topic Re: How to write a Rex query that will ignore some characters and then extract the message? in Splunk Search

How to write a Rex query that will ignore some characters and then extract the message?

Splunk235 — Fri, 29 Sep 2023 17:06:39 GMT

I have error logs like the below. How can I write a Rex query to match both the logs and only extract the message after the first colon (:)? Thanks.

Sample Log lines:

Script exception for job id 'ABc12345' : Too many rows: 500.

Script exception for job id 'XyZ78943' : Too many DMLs: 20.

Results should be:

Too many rows: 500.

Too many DMLs: 20.

gcusello — Fri, 29 Sep 2023 17:11:42 GMT

please try this regex:

| rex "Script exception for job id \'\w*\d*\' : (?<message>[^\.]*)"

Ciao.

Giuseppe

Thulasinathan_M — Fri, 29 Sep 2023 17:42:49 GMT

Hi,
Here is the try anywhere query for your requirement.

| makeresults | eval _raw="Script exception for job id 'ABc12345' : Too many rows: 500." | rex field=_raw ": (?<Extracted>.*)"

Splunk235 — Fri, 29 Sep 2023 18:02:58 GMT

Is there a way to embed the same into this query?

rex field=logLine "(Error Occurred During Script|UnhandledException ->)(\s|\S)(?<errorMessage>.*)"

This didn't work, but something like this?

rex field=logLine "(Error Occurred During Script|for job id \'\w*\d*\' :|UnhandledException ->)(\s|\S)(?<errorMessage>.*)"

gcusello — Sat, 30 Sep 2023 06:28:02 GMT

yes, you can test your regex and it runs.

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

gcusello — Mon, 02 Oct 2023 16:40:07 GMT

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉