https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286574#M86788 <P>in the same event i have one more <BR /> "msgContentType":"Exception occured Retirement Audit Rest service"</P> <P>it is retriving "Exception occured Retirement Audit Rest service"</P> <P>whai need is "java.net.SocketTimeoutException: Read timed out"</P> Mon, 06 Feb 2017 15:50:21 GMT sravankaripe 2017-02-06T15:50:21Z https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286572#M86786 <P>please help me with rex<BR /> i want to retrieve <CODE>java.net.SocketTimeoutException: Read timed out</CODE> from below _raw</P> <PRE><CODE>"msgContentType":"java.net.SocketTimeoutException: Read timed out" </CODE></PRE> Mon, 06 Feb 2017 15:35:46 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286572#M86786 sravankaripe 2017-02-06T15:35:46Z https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286573#M86787 <P>Hi sravankaripe<BR /> try</P> <PRE><CODE>\"msgContentType\"\:\"(?&lt;your_field&gt;[^\"]*) </CODE></PRE> <P>see at <A href="https://regex101.com/r/eNg0P0/1">https://regex101.com/r/eNg0P0/1</A><BR /> Bye.<BR /> Giuseppe</P> Mon, 06 Feb 2017 15:41:08 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286573#M86787 gcusello 2017-02-06T15:41:08Z https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286574#M86788 <P>in the same event i have one more <BR /> "msgContentType":"Exception occured Retirement Audit Rest service"</P> <P>it is retriving "Exception occured Retirement Audit Rest service"</P> <P>whai need is "java.net.SocketTimeoutException: Read timed out"</P> Mon, 06 Feb 2017 15:50:21 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286574#M86788 sravankaripe 2017-02-06T15:50:21Z https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286575#M86789 <P>what* need is "java.net.SocketTimeoutException: Read timed out"</P> Mon, 06 Feb 2017 15:51:09 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286575#M86789 sravankaripe 2017-02-06T15:51:09Z https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286576#M86790 <P>try this<BR /> \"msgContentType\":\"(?java[^\"]*)<BR /> see <A href="https://regex101.com/r/eNg0P0/2">https://regex101.com/r/eNg0P0/2</A><BR /> Bye.<BR /> Giuseppe</P> Mon, 06 Feb 2017 16:01:31 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286576#M86790 gcusello 2017-02-06T16:01:31Z https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286577#M86791 <P>sry not working</P> Mon, 06 Feb 2017 16:28:26 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286577#M86791 sravankaripe 2017-02-06T16:28:26Z https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286578#M86792 <P>Can you share some example of your logs, to detail the regex?<BR /> because as you can see in regex101 it seems to work..<BR /> Bye.<BR /> Giuseppe</P> Mon, 06 Feb 2017 16:31:46 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286578#M86792 gcusello 2017-02-06T16:31:46Z https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286579#M86793 <P>i have one more content in same event.<BR /> i think will it helps you i think to retrive <BR /> java.net.SocketTimeoutException: Read timed out</P> <P>"msgQueryString":"com.wm.app.b2b.server.ServiceException: java.net.SocketTimeoutException: Read timed out\n\</P> Mon, 06 Feb 2017 16:35:17 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286579#M86793 sravankaripe 2017-02-06T16:35:17Z https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286580#M86794 <P>try now</P> <PRE><CODE>\"[^\"]*\"\:\".*\s(?&lt;your_field&gt;java[^\"]*) </CODE></PRE> <P>see <A href="https://regex101.com/r/eNg0P0/3">https://regex101.com/r/eNg0P0/3</A></P> <P>Bye.<BR /> Giuseppe</P> Mon, 06 Feb 2017 16:42:28 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286580#M86794 gcusello 2017-02-06T16:42:28Z https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286581#M86795 <P>got it thanks</P> Mon, 06 Feb 2017 16:44:08 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-regular-expression-to-extract-quot-java-net/m-p/286581#M86795 sravankaripe 2017-02-06T16:44:08Z