topic how to extract from java.lang in Splunk Search

how to extract from java.lang

GreeshmaV — Mon, 16 Feb 2015 09:02:06 GMT

My events look like this
TYP=ERR, TS1=1423574799157, TS2=1423574799157, CMP=PUR, EDESC=Unknown Host
java.lang.Exception: Validation failed: input param is NULL
LogClient.java:39)

How to extract from java.lang.Exception to the end of the event using regular expression

Re: how to extract from java.lang

richgalloway — Mon, 16 Feb 2015 13:24:12 GMT

Is that the entire event? I ask because of the mis-matched paren. Is it a single-line or multi-line event?

Re: how to extract from java.lang

thomrs — Tue, 17 Feb 2015 02:30:48 GMT

Off the top of my head something like this

(?i)java.lang.Exception:\s?<field>(.+)$

Re: how to extract from java.lang

GreeshmaV — Tue, 17 Feb 2015 05:08:23 GMT

its multiline event

Re: how to extract from java.lang

thomrs — Tue, 17 Feb 2015 11:47:00 GMT

add (?ms) on the beginning - the s is dotall, and the m is multi-line.

 (?ms)java.lang.Exception:\s?<field>(.+)

Re: how to extract from java.lang

cpetterborg — Tue, 24 Feb 2015 18:10:32 GMT

This works for my data (YMMV) at search time:

"java.lang.Exception" | rex field=_raw "(?ms)java.lang.Exception(?P<exception>.+)"