topic Re: Need Help in extracting the field in Splunk Search

Need Help in extracting the field

AL3Z — Mon, 05 Feb 2024 12:19:39 GMT

Hi all,

help me extracting the field from the below two events
System.Exception: Assertion violated: stream.ReadByteInto(bufferStream) == 0x03
System.Exception: An error was encountered while attempt to fetch proxy credentials for user 'xyz

system_exception=Assertion violated: stream.ReadByteInto

An error was encountered while attempt to fetch proxy credentials for user

thanks

Re: Need Help in extracting the field

scelikok — Mon, 05 Feb 2024 13:28:39 GMT

Hi @AL3Z ,

Please try below;

| rex field=_raw "System\.Exception:\s+(?<system_exception>[^\(\']+)"

Re: Need Help in extracting the field

AL3Z — Mon, 05 Feb 2024 14:13:58 GMT

Hi @scelikok ,

Can you pls explain this part I didnt understand [^\(\']+)

Re: Need Help in extracting the field

isoutamo — Mon, 05 Feb 2024 15:28:37 GMT

Hi
I match all other characters except ( and ' and there must be at least one or more those with any order and combination.
You can test these e.g. regex101.com.
There is also descriptions what all those anchors etc. are/meaning.
r. Ismo