topic Re: How do I extract this field from my sample data? in Splunk Search

How do I extract this field from my sample data?

splgeek — Wed, 26 Oct 2016 19:46:50 GMT

I want to extract the PHP Message as a field so I can have all the various php error messages:

2016/10/20 21:23:18 [error] 26550#26550: *9254611 FastCGI sent in stderr: "PHP message: PHP Warning:  trim() expects parameter 1 to be string, array given in /var/www/html/xx/xxxx-xx.xxxx.xxx.com/wordpress/wp-includes/option.php on line 247" while reading response header from upstream, client: 0.0.0.00, server: _, request: "GET / HTTP/1.1", upstream: "fastcgi://000.0.0.1:9000", host: "xxx.xx.com"

Re: How do I extract this field from my sample data?

somesoni2 — Wed, 26 Oct 2016 19:55:27 GMT

Give this a try

your base search | rex "PHP message\: (?<PHPError>[^\"]+)"

Re: How do I extract this field from my sample data?

splgeek — Wed, 26 Oct 2016 20:07:08 GMT

thanks
that did work
so this could not have been possible with the IFX right?

Re: How do I extract this field from my sample data?

somesoni2 — Wed, 26 Oct 2016 20:33:29 GMT

I think it would. Be sure to select the whole string that you want to extract OR you can specify your own regex (this one) in the IFX to save it.