topic How can I rex on an exact error code? in Splunk Search

How can I rex on an exact error code?

splgeek — Tue, 01 Nov 2016 14:47:03 GMT

Hello ppl
I have a set of Error messages in an event log that looks like this
ERROR [43f796d8da] there are several codes like this in the events, so i don't want to miss out extracting them

What would be the rex command so that I could extract the Error codes and assign it to a field called Errortype?

Re: How can I rex on an exact error code?

gokadroid — Tue, 01 Nov 2016 15:05:20 GMT

If the error code exists once in every log event then try these please:

1) If you want the ERROR word and square brackets in the string as well:

yourBaseSearch
| rex "(?<Errortype>ERROR\s\[[^\]]+\])"
| complete your query using Errortype field

See result here

2) If you only want only the code within the brackets, try:

yourBaseSearch
| rex "ERROR\s\[(?<Errortype>[^\]]+)\]"
| complete your query using Errortype field

See results here

Re: How can I rex on an exact error code?

ehudb — Tue, 01 Nov 2016 15:05:31 GMT

|rex "\w+\s\[(?<Errortype>[^\]]+)]"

Explanation:
A. Word with one or more letter
B. one or more space
C. starting bracket '['
D. One or more Non-Closing bracket ']' character (will be the field value)
E. Closing bracket ']'