All Apps and Add-ons

How to extract stored procedure names from the splunk message

New Member

Hi 👋

If I have below sample message how can I extract procedure names from it, I'm pretty new to splunk any help or guidance would be great.

I would like to extract the highlighted message.


...lib.service.exc.ServiceHTTPError: service=svysvc_v2 url=http://x-vip/v2/sys/505019269 http_status=500 error={"code":500,"status":500,"error":{"service":null,"reason":"Unhandled exception","type":"unhandled-exception","error":"OperationalError: (pymssql._pymssql.OperationalError) (10316, b'The app domain with specified version id (84271) was unloaded due to memory pressure and could not be found.DB-Lib error message 20018, severity 16:\\nGeneral SQL Server error: Check messages from the SQL Server\\n')\n[SQL: \n \n \n EXEC Database01.dbo.Procedure01\n @ids=%(ids)s,@den(den)s,@Visible=(visible)s;\n ...


I'm trying to extract all the failed procedures from the error logs and get the counts by each procedure.

Thank you

Labels (1)
0 Karma


It is not clear which part of the message you are interested in.

Can you share the complete event?

Do you already have some fields extracted for the events?

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...