Splunk Enterprise

I want to look for certain text and extract that field and make a report

mikeyty07
Communicator
index=abc "exception":"java.util.concurrent.ExecutionException" searching above displays like these in below events "exception":"java.util.concurrent.ExecutionException: ABC_1000:We're sorry, it looks like an error occurred while getting information" "exception":"java.util.concurrent.ExecutionException: ABC-2000:We're sorry, it looks like an error occurred while getting information" I want to take the ABC_ OR ABC- error codes and have a report based on that which should look like this ABC Codes message counts ABC_1000 We're sorry, it looks like an error occurred while getting information 3 ABC-2000 We're sorry, it looks like an error occurred while getting information 5
Labels (1)
0 Karma

rupkumar4sec
Path Finder
index=abc "exception":"java.util.concurrent.ExecutionException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| stats count by  ABC_CODE, Message
0 Karma

mikeyty07
Communicator
index=abc "exception":"java.util.concurrent.ExecutionException" searching above displays like these in below events "exception":"java.util.concurrent.ExecutionException: ABC_1000:We're sorry, it looks like an error occurred while getting information" "exception":"java.util.concurrent.ExecutionException: ABC-2000:We're sorry, it looks like an error occurred while getting information" I want to take the ABC_ OR ABC- error codes and have a report based on that which should look like this ABC Codes message counts ABC_1000 We're sorry, it looks like an error occurred while getting information 3 ABC-2000 We're sorry, it looks like an error occurred while getting information 5
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...