Splunk Enterprise

How to create a regex to capture first two lines following the word 'ERROR'?

Ashwini008
Builder

Hi,

I need to capture first two line following the word 'ERROR' from the log file.

Example 1:
2022-05-20 11:36:22,393 ERROR [com.https.custom.integration.Integration](WFA:346899 - 5678976 triExecute:671116263 IE=671116263) com.https.platform.smartobject.dataaccess.SmartObjectNotFoundException: No Smart Object with id '-1' exists
com.https.platform.smartobject.dataaccess.SmartObjectNotFoundException: No Smart Object with id '-1' exists
at com.https.platform.smartobject.dataaccess.SmartObjectDaoImpl.read(SmartObjectDaoImpl.java:131)

Example 2:
2022-05-20 11:36:36,804 ERROR [com.https.ws.https](Thread-789) com.https.ws.errors.AccessException: User does not have access to create records in this GUI. [User:- , GUI: triIntegrationInstance]
com.https.ws.errors.AccessException: User does not have access to create records in this GUI. [User: ahmuy, wasim- kb4567, GUI: triIntegrationInstance]
at com.https.ws.utils.Validator.validateCreateAccess(Validator.java:588)
at com.https.ws.WSProcessThread.processRecord(WSProcessThread.java:258)
at com.https.ws.WSProcessThread.run(WSProcessThread.java:147)

Please help me with regex.



Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "ERROR (?<error>.*\n.*)"

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

What have you tried so far?  How did those efforts fail to meet expectations?
Are the lines all in a single event or in multiple events?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Ashwini008
Builder

@richgalloway It is single event.

@ITWhisperer Can you please help here

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "ERROR (?<error>.*\n.*)"
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

&#x1f48c;Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...