https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177144#M50899 <P>Correct, it is a multiline event using a regex to parse the Start and End on the indexer manually for a transaction in our system. I have stopped working on this piece due to the random number of errors that can be thrown, as there is no consistency.</P> Tue, 17 Dec 2013 23:55:19 GMT icyfeverr 2013-12-17T23:55:19Z https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177139#M50894 <P>I have an event that has multiple lines, it can have multiple Errors in the event and I need to query either the first or last error from the event. Does anyone know how to do this by chance? I am needing it for a chart to display errors, but the multiple codes are causing the numbers to be skewed.</P> Thu, 12 Dec 2013 20:15:21 GMT https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177139#M50894 icyfeverr 2013-12-12T20:15:21Z https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177140#M50895 <P>Can you post an example event?<BR /> That will make it easier to create a regex that will grab the first or last error in it.</P> Thu, 12 Dec 2013 20:17:40 GMT https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177140#M50895 lukejadamec 2013-12-12T20:17:40Z https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177141#M50896 <P>[2010-08-12 11:54:56.281][ERROR] [ 4363 ] - User credentials are invalid. <BR /> [2010-08-12 11:54:56.281][ERROR]AuthResultUserUnknownException <BR /> [2010-08-12 11:54:56.281][ERROR] [ 4370 ] - User ****** is unknown. Auth result code = 15. <BR /> [2010-08-12 11:54:56.281][ERROR]AuthInterfaceException <BR /> [2010-08-12 11:54:56.281][ERROR] [ 4363 ] - User credentials are invalid.</P> Thu, 12 Dec 2013 20:41:46 GMT https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177141#M50896 icyfeverr 2013-12-12T20:41:46Z https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177142#M50897 <P>And this is an example of a single event, not six events? </P> <PRE><CODE>... | rex "ERROR\]\s?(?&lt;err_msg&gt;[^\r\n]+)" </CODE></PRE> <P>ought to work..</P> Thu, 12 Dec 2013 21:00:54 GMT https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177142#M50897 kristian_kolb 2013-12-12T21:00:54Z https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177143#M50898 <P>So you could use dedup to find the most recent event:</P> <PRE><CODE> sourcetype=foo | dedup error_code by host | timechart count by error_code </CODE></PRE> <P>Does this give you what you need?</P> Mon, 16 Dec 2013 14:11:42 GMT https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177143#M50898 dart 2013-12-16T14:11:42Z https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177144#M50899 <P>Correct, it is a multiline event using a regex to parse the Start and End on the indexer manually for a transaction in our system. I have stopped working on this piece due to the random number of errors that can be thrown, as there is no consistency.</P> Tue, 17 Dec 2013 23:55:19 GMT https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177144#M50899 icyfeverr 2013-12-17T23:55:19Z https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177145#M50900 <P>I have stopped working on this piece due to the random number of errors that can be thrown, as there is no consistency. I appreciate the help, but will need to address at a later time after modifications to the logs can be done.</P> Tue, 17 Dec 2013 23:56:01 GMT https://community.splunk.com/t5/Splunk-Search/Parse-first-last-error-in-an-event/m-p/177145#M50900 icyfeverr 2013-12-17T23:56:01Z