Hello
I'm trying to use a field that has values that have spaces.
For example: errorMsg=Requested tickets could not be reserved
another example: errorMsg=System.ObjectDisposedException: The factory was disposed and can no longer be used. Object name: 'this'.
The problem is that the messages contain spaces. All of the messages are different in this field, some longer with less spaces and some shorter. When I do a stats count command on the errorMsg field but all I get is the first word of the string.
Any ideas on how I can correct this?
I also tried using the Field Extractor but alas no good.
Thank you!
Well you could extract the value from the the event and then assign it to a new filed. Take a chance with the below one.
source...| rex field=_raw "errorMsg=(?P<Error>[\S\s]+)" |stats count by Error
Thanks
Both of these seemed to be correct answers. The first solves inline and the second works great as an extraction. Thanks for the help guys, I greatly appreciate it!
Well you could extract the value from the the event and then assign it to a new filed. Take a chance with the below one.
source...| rex field=_raw "errorMsg=(?P<Error>[\S\s]+)" |stats count by Error
Thanks
yes after the = sign there is always a message like examples above. It is NEVER NULL. When I use the stats command I only get the first word of the message
i meant after = sign do you have the error message or do you get something else??
but it is always more than one word
No sometimes it is something more simple as: errorMsg=Requested tickets could not be reserved
do you have the entire sentence always as the error message after errorMsg=?