Building for the Splunk Platform

Field Extraction is capturing too much

jeck11
Path Finder

Hello,

I'm not great with regex and I've been looking at lots of examples of how to only grab the first instance of a match but I can't make it work. Here is what I've got so far:

^ErrorMsg\:\s(?<Error_Code>.*)\s\((?<Error_Timestamp>\d+\/\d+\/\d+\s\d+\:\d+\s\w+)\)

This returns the following:
Example Results

You can see that the bottom two lines are going all the way out because they find a second match because of the way the event is being broken out for this source.

How can I get it to ONLY match the first instance of the error code and timestamp?

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

What nick says: fix your linebreaking, as it seems to be showing multiple events glued together.

But I would also try to avoid using .*. Assuming error codes cannot contain () characters, the following should also work and is much safer and also performs much better:
^ErrorMsg\:\s(?<Error_Code>[^\(]*)\s\((?<Error_Timestamp>\d+\/\d+\/\d+\s\d+\:\d+\s\w+)\)

View solution in original post

jnahuelperez35
Path Finder

If you want to trap only the first "AwE-4444 Agent/client/database/network" this could help

\w+-\d+\s\w+

Let me know if this helps

0 Karma

jeck11
Path Finder

Thank you for helping make it less greedy. Unfortunately, I don't know how many times I'd have to repeat the \s\w combo. I'm not sure how many words can be in the error code's name.

0 Karma

FrankVl
Ultra Champion

What nick says: fix your linebreaking, as it seems to be showing multiple events glued together.

But I would also try to avoid using .*. Assuming error codes cannot contain () characters, the following should also work and is much safer and also performs much better:
^ErrorMsg\:\s(?<Error_Code>[^\(]*)\s\((?<Error_Timestamp>\d+\/\d+\/\d+\s\d+\:\d+\s\w+)\)

jeck11
Path Finder

I agree with both you and Nick that the root of the issue is the sourcetype configuration but that one is beyond me. I'm hoping that our admin will be able to come up with something better.

Your suggestion worked perfectly though! TY

0 Karma

nickhills
Ultra Champion

The root cause of this looks like your event breaking is failing.

Have you configured any breaking or Timestamp extraction in props.conf for this sourcetype?

If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...