Field values with spaces

[tkwaller]

Hello

I'm trying to use a field that has values that have spaces.

For example: errorMsg=Requested tickets could not be reserved

another example: errorMsg=System.ObjectDisposedException: The factory was disposed and can no longer be used. Object name: 'this'.

The problem is that the messages contain spaces. All of the messages are different in this field, some longer with less spaces and some shorter. When I do a stats count command on the errorMsg field but all I get is the first word of the string.

Any ideas on how I can correct this?

I also tried using the Field Extractor but alas no good.

Thank you!

[tkwaller]

Both of these seemed to be correct answers. The first solves inline and the second works great as an extraction. Thanks for the help guys, I greatly appreciate it!

[linu1988 · Accepted solution]

Well you could extract the value from the the event and then assign it to a new filed. Take a chance with the below one.

source...| rex field=_raw "errorMsg=(?P<Error>[\S\s]+)" |stats count by Error

Thanks

[tkwaller]

yes after the = sign there is always a message like examples above. It is NEVER NULL. When I use the stats command I only get the first word of the message

[linu1988]

i meant after = sign do you have the error message or do you get something else??

[tkwaller]

but it is always more than one word

[tkwaller]

No sometimes it is something more simple as: errorMsg=Requested tickets could not be reserved

[linu1988]

do you have the entire sentence always as the error message after errorMsg=?