Splunk Enterprise

How to create a regex to capture first two lines following the word 'ERROR'?

Ashwini008
Builder

Hi,

I need to capture first two line following the word 'ERROR' from the log file.

Example 1:
2022-05-20 11:36:22,393 ERROR [com.https.custom.integration.Integration](WFA:346899 - 5678976 triExecute:671116263 IE=671116263) com.https.platform.smartobject.dataaccess.SmartObjectNotFoundException: No Smart Object with id '-1' exists
com.https.platform.smartobject.dataaccess.SmartObjectNotFoundException: No Smart Object with id '-1' exists
at com.https.platform.smartobject.dataaccess.SmartObjectDaoImpl.read(SmartObjectDaoImpl.java:131)

Example 2:
2022-05-20 11:36:36,804 ERROR [com.https.ws.https](Thread-789) com.https.ws.errors.AccessException: User does not have access to create records in this GUI. [User:- , GUI: triIntegrationInstance]
com.https.ws.errors.AccessException: User does not have access to create records in this GUI. [User: ahmuy, wasim- kb4567, GUI: triIntegrationInstance]
at com.https.ws.utils.Validator.validateCreateAccess(Validator.java:588)
at com.https.ws.WSProcessThread.processRecord(WSProcessThread.java:258)
at com.https.ws.WSProcessThread.run(WSProcessThread.java:147)

Please help me with regex.



Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "ERROR (?<error>.*\n.*)"

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

What have you tried so far?  How did those efforts fail to meet expectations?
Are the lines all in a single event or in multiple events?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Ashwini008
Builder

@richgalloway It is single event.

@ITWhisperer Can you please help here

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "ERROR (?<error>.*\n.*)"
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...