topic Re: Help needed in extracting string between two similar strings in Splunk Search

Help needed in extracting string between two similar strings

Nadal7noval — Fri, 13 Oct 2017 03:10:10 GMT

I have a log mentioned below:

ERROR: Cannot retrieve requested details in 103 ms cause: [50000] ERROR: Building profile failed in 103 ms cause: [000026] ERROR: Cannot build requested profile in 99 ms cause: [5100007] ERROR: Cannot get details for ID : [[ ID ]] cause: Retrieve details failure cause:

I need to extract the string that starts from 1st "ERROR:" to 2nd "cause:" word.
I am using rex field=_raw "(?ERROR.*)cause:"
It is giving me complete string till the last cause. Can you help me with rex to stop at 2nd cause:

Expected result:
ERROR: Cannot retrieve requested details in 103 ms cause: [50000] ERROR: Building profile failed in 103 ms

Re: Help needed in extracting string between two similar strings

gcusello — Fri, 13 Oct 2017 11:39:15 GMT

Hi Nadal7noval,
try this

(?<ERROR>(ERROR:.*cause:\s\[\d+\]\s+){2})

| rex "(?<ERROR>(ERROR:.*cause:\s\[\d+\]\s+){2})"

test it at https://regex101.com/r/rrhW1y/1

Bye.
Giuseppe

Re: Help needed in extracting string between two similar strings

jincy_18 — Fri, 13 Oct 2017 13:41:03 GMT

Hi Nadal7noval,

You can try below:

(?<ERROR>(ERROR:.+?){2})(?=cause\:\s\[)

(?<ERROR>(ERROR:.+?){2})(?=cause\:)