topic Re: Creating a new field from a default field in Splunk Search

Creating a new field from a default field

olbinado11 — Tue, 25 Jul 2017 08:30:34 GMT

MessageText=
[2017-07-25T16:29:01.694+10:00]...XXXXXXXXXXXXXXXXXXXXXXXXXX at com.ofss.fc.app.Interaction.analyzeAndThrowException(Interaction.java:1349) Caused by: com.ofss.fc.framework.exception.BusinessException: No address linkage is maintained for Account ID: 74XX15140985.** at com.ofss.fc.domain.account.service.action.accountaddresslinkage.AccountAddressLinkageService.fetchAccountAddressLinkage(AccountAddressLinkageService.java:233) ]]

My goal is to create a new field, "rootcause" where it starts after the string "Caused by: " and ends before the string "at com." I figured rex command will do the trick? I tried field extractor but my searches returns to "no results found".

Re: Creating a new field from a default field

gcusello — Tue, 25 Jul 2017 08:34:39 GMT

Hi olbinado11,
try something like this

Caused by:(?<your_field>.*)\sat\scom.

You can test it at https://regex101.com/r/8BdlXU/1
Bye.
Giuseppe

Re: Creating a new field from a default field

olbinado11 — Wed, 26 Jul 2017 01:25:35 GMT

|rex field=MessageText "\Caused by:(?.*)\sat\scom."

Unfortunately not working.

Re: Creating a new field from a default field

niketn — Wed, 26 Jul 2017 04:34:52 GMT

@olbinado11, post your data and current rex command using the code button so that special characters do not escape/get omitted in the post.

In case your event has new line character after each line you will have to use (?s) in the rex command so that DOT (.) matches newline characters as well i.e. | rex field=Message "(?s)Caused by:(?<myField>.*)\sat\s"

| makeresults
| eval Message="[2017-07-25T16:29:01.694+10:00]...XXXXXXXXXXXXXXXXXXXXXXXXXX at com.ofss.fc.app.Interaction.analyzeAndThrowException(Interaction.java:1349) **Caused by: com.ofss.fc.framework.exception.BusinessException: No address linkage is maintained for Account ID: 74XX15*140985.* at com.ofss.fc.domain.account.service.action.accountaddresslinkage.AccountAddressLinkageService.fetchAccountAddressLinkage(AccountAddressLinkageService.java:233) ]]"
| rex field=Message "Caused by:(?<myField>.*)\sat\s"

Also, have you extracted Message field already and ensured that the sample data is being reflected when you use | table Message command? If not change rex to process on _raw instead of Message field i.e. | rex field=_raw "Caused by:(?<myField>.*)\sat\s"

PS: Rex should only be used for testing. You should ideally be creating Field Extractions (better using Splunk's Interactive Field Extraction IFX : http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX)

Re: Creating a new field from a default field

gcusello — Wed, 26 Jul 2017 07:40:39 GMT

strange, in regex101 is working!
https://regex101.com/r/8BdlXU/3

did you tried?

your_search
| rex "(?s)Caused by:(?<rootcause>.*)\sat\scom."
| ...

Bye.
Giuseppe

Re: Creating a new field from a default field

olbinado11 — Wed, 26 Jul 2017 08:17:07 GMT

@niketnilay,

| rex field=_raw "Caused by:(?.*)\sat\s" still does not give me the result i need..

however after playing around with what you have shared.. i come up with this...

|rex field=MessageText "\Caused by:(?.*)\s..."

i feel that the above \ before Caused and the ... after \s did the charm.. but no idea how.

I am sorry for asking this but can you explain how it worked?