Hi Everyone,
How can I extract the Below word OutOfMemoryError from the splunk losg
2021-03-24T09:01:32.357185211Z app_name=dgfassetmutation environment=e1 ns=blazepsfsubscribememsql-c2 pod_container=dgfassetmutation pod_name=dgfassetmutation-deployment-3-p24np stream=stdout message=Terminating due to java.lang.OutOfMemoryError: Metaspace
2021-03-03T12:45:30.036179788Z app_name=pulldataoneforce environment=e1 ns=blazepsfpublish pod_container=pulldataoneforce pod_name=pulldataoneforce-deployment-175-kv9tv stream=stdout message=Caused by: java.lang.OutOfMemoryError: unable to create new native thread
Thanks in advance
You put message= outside group capture.
| rex "message=(?<message>[^\n]+)"
hi @aditsss,
Try this, highlighted values will be part of field error.
| rex "java\.lang\.(?<error>\w+)\:\s(?<error_msg>[^\n]+)"
If this reply helps you, an upvote/like would be appreciated.
I want to show the complete error message (The highlighted one)
2021-03-24T09:01:32.357185211Z app_name=dgfassetmutation environment=e1 ns=blazepsfsubscribememsql-c2 pod_container=dgfassetmutation pod_name=dgfassetmutation-deployment-3-p24np stream=stdout message=Terminating due to java.lang.OutOfMemoryError: Metaspace
2021-03-03T12:45:30.036179788Z app_name=pulldataoneforce environment=e1 ns=blazepsfpublish pod_container=pulldataoneforce pod_name=pulldataoneforce-deployment-175-kv9tv stream=stdout message=Caused by: java.lang.OutOfMemoryError: unable to create new native thread
How can I extract the complete message
Try this:
| rex "(?<message>message=[^\n]+)"
Its working fine but I want to remove message= part. Currently its coming like this:
message=Caused by: java.lang.NullPointerException: null
I want it to show like this:
Caused by: java.lang.NullPointerException: null
How can I achieve this
You put message= outside group capture.
| rex "message=(?<message>[^\n]+)"