Newb trying to use regex to extract fields

[johnmackey]

I'm still trying to understand rex to extract data from my search results. Can someone help me build a regex command with these examples please?

I'm trying to pull out the exception type (i.e. BwbRequestExceptions) and message into 2 separate fields:

com.beeweeb.mobileservices.tapestry.exceptions.BwbRequestException: Error while parsing server request

org.jboss.resteasy.plugins.providers.jaxb.JAXBUnmarshalException: javax.xml.bind.UnmarshalException
- with linked exception:
[org.xml.sax.SAXParseException: Content is not allowed in prolog.]

[rgaleone1]

johnmackey -

Have you tried looking in to using the built-in Splunk Interactive Field Extractor?

Documentation here: Knowledge Users Manual and here: Extract fields interactively with IFX

[johnmackey]

Thanks! i'll try IFX. i think this is what i need.

[rgaleone1]

Yes, the Splunk Interactive Field Extractor is available in Splunk 5

Update for Spunk 5.x
Documentation here: Knowledge Users Manual and here: Extract fields interactively with IFX

You can change the documentation version (from 6.x to 5.x or w/e) in the upper right of the web page.

[johnmackey]

i'm in splunk 5. is that only in 6?