How to Extract the field from Splunk Logs

[aditsss]

Hi Everyone,

How can I extract the Below word OutOfMemoryError from the splunk losg

2021-03-24T09:01:32.357185211Z app_name=dgfassetmutation environment=e1 ns=blazepsfsubscribememsql-c2 pod_container=dgfassetmutation pod_name=dgfassetmutation-deployment-3-p24np stream=stdout message=Terminating due to java.lang.OutOfMemoryError: Metaspace

2021-03-03T12:45:30.036179788Z app_name=pulldataoneforce environment=e1 ns=blazepsfpublish pod_container=pulldataoneforce pod_name=pulldataoneforce-deployment-175-kv9tv stream=stdout message=Caused by: java.lang.OutOfMemoryError: unable to create new native thread

Thanks in advance

[manjunathmeti]

hi @aditsss,
Try this, highlighted values will be part of field error.

| rex "java\.lang\.(?<error>\w+)\:\s(?<error_msg>[^\n]+)"

If this reply helps you, an upvote/like would be appreciated.

[aditsss]

@manjunathmeti 

I want to show the complete error message (The highlighted one)

2021-03-24T09:01:32.357185211Z app_name=dgfassetmutation environment=e1 ns=blazepsfsubscribememsql-c2 pod_container=dgfassetmutation pod_name=dgfassetmutation-deployment-3-p24np stream=stdout message=Terminating due to java.lang.OutOfMemoryError: Metaspace

2021-03-03T12:45:30.036179788Z app_name=pulldataoneforce environment=e1 ns=blazepsfpublish pod_container=pulldataoneforce pod_name=pulldataoneforce-deployment-175-kv9tv stream=stdout message=Caused by: java.lang.OutOfMemoryError: unable to create new native thread

 How can I extract the complete message

[manjunathmeti]

Try this:

| rex "(?<message>message=[^\n]+)"

[aditsss]

@manjunathmeti 

Its working fine but I want to remove message= part. Currently its coming like this:

message=Caused by: java.lang.NullPointerException: null

I want it to show like this:

Caused by: java.lang.NullPointerException: null

How can I achieve this

[manjunathmeti · Accepted solution]

You put message= outside group capture.

| rex "message=(?<message>[^\n]+)"