https://community.splunk.com/t5/Splunk-Search/How-to-write-REXG-when-there-is-no-field/m-p/270759#M81503 <P>I have a blog post on this subject: <A href="http://blog.hortonew.com/how-to-use-regex-rex-in-splunk">http://blog.hortonew.com/how-to-use-regex-rex-in-splunk</A></P> Tue, 31 Jan 2017 16:52:02 GMT hortonew 2017-01-31T16:52:02Z https://community.splunk.com/t5/Splunk-Search/How-to-write-REXG-when-there-is-no-field/m-p/270757#M81501 <P>Failed to determine DORG Access: HTTP 413 Request Entity Too Large</P> <P>pls provide some explain -- how regx works in splunk ...</P> Tue, 31 Jan 2017 16:28:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-REXG-when-there-is-no-field/m-p/270757#M81501 jw44250 2017-01-31T16:28:27Z https://community.splunk.com/t5/Splunk-Search/How-to-write-REXG-when-there-is-no-field/m-p/270758#M81502 <P>regx field = _row "Failed*(?i</P> Tue, 31 Jan 2017 16:47:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-REXG-when-there-is-no-field/m-p/270758#M81502 jw44250 2017-01-31T16:47:44Z https://community.splunk.com/t5/Splunk-Search/How-to-write-REXG-when-there-is-no-field/m-p/270759#M81503 <P>I have a blog post on this subject: <A href="http://blog.hortonew.com/how-to-use-regex-rex-in-splunk">http://blog.hortonew.com/how-to-use-regex-rex-in-splunk</A></P> Tue, 31 Jan 2017 16:52:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-REXG-when-there-is-no-field/m-p/270759#M81503 hortonew 2017-01-31T16:52:02Z https://community.splunk.com/t5/Splunk-Search/How-to-write-REXG-when-there-is-no-field/m-p/270760#M81504 <P>really good blog post thank you --</P> <P>how to exclude the word exception from below query</P> <P>this splunk query index = index Exception | rex ".<EM>?(?(?:\w+.)+\w</EM>?Exception).*"<BR /> | stats count by exception</P> <P>result : Uncaught exception: no Access Rule found for key ---<BR /> java.lang.exception ..</P> <P>this query catches the word exception as well but i'm not interested in work exception -- <BR /> i am interested the following </P> <P>java.io.IOException</P> <P>java.lang.Exception</P> <P>java.lang.IllegalAccessException</P> <P>java.lang.reflect.InvocationTargetException<BR /> java.lang.RuntimeException<BR /> java.net.ConnectException,<BR /> java.net.SocketException<BR /> java.rmi.NoSuchObjectException</P> <P>java.util.MissingResourceException</P> <P>javax.ejb.NoSuchEJBException</P> <P>javax.faces.application.ViewExpiredException<BR /> javax.faces.FacesException</P> Tue, 31 Jan 2017 17:35:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-REXG-when-there-is-no-field/m-p/270760#M81504 jw44250 2017-01-31T17:35:15Z