Splunk Enterprise

Splunk rex field

DougiieDee
Explorer

How do i extract this message in splunk rex field to display error code and message in reports like ABC_Code and Message?
"
exception":"java.util.concurrent.ExecutionException: ABC_1000:We're sorry, it looks like an error occurred while getting information"

Labels (1)
0 Karma
1 Solution

rupkumar4sec
Path Finder

Yeah it is just a rex command so it will show raw events. If you want a table like you asked in  one of your comments use below search 

index=abc "exception":"java.util.concurrent.ExecutionException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| stats count by  ABC_CODE, Message

View solution in original post

0 Karma

pavanbmishra
Path Finder

\"exception\"\:\"\w+\.\w+\.\w+\.\w+\:\s+(?P<CODE>.*)\:(?<message>.*)\"

0 Karma

rupkumar4sec
Path Finder

Try below regular expression

 

|rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"

 

Assuming your message ends with double quotes(")

0 Karma

DougiieDee
Explorer

didnt work for this as well shows all the logs

 

0 Karma

rupkumar4sec
Path Finder

Yeah it is just a rex command so it will show raw events. If you want a table like you asked in  one of your comments use below search 

index=abc "exception":"java.util.concurrent.ExecutionException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| stats count by  ABC_CODE, Message
0 Karma

DougiieDee
Explorer

this looks good but is there a way to minimize message to limited text instead of whole events error?

0 Karma

rupkumar4sec
Path Finder

You use an eval command with substr function to get a part of that message.

Example: To get first 10 letters

| eval Message=substr(Message, 1, 10)

I hope I understood what you are looking for.

0 Karma

DougiieDee
Explorer

this looks better. how do i add another exception here with "exception":"ExecutionException" in below. so there will be two. 
index=abc "exception":"CommonApplicationException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| eval Message=substr(Message, 1, 140)
| stats count by ABC_CODE, Message

Also how to add this same rex field there?


ABC-* |rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)" | where ABC_Code!="" | search ABC_Code=* | stats count by ABC_CODE, Message

0 Karma

rupkumar4sec
Path Finder

index=abc ("exception":"CommonApplicationException" OR "exception":"ExecutionException")
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)"

| eval Message=substr(Message, 1, 140)
| stats count by ABC_CODE, Message

Added your other key word and regular expression. I hope that new regular expression is working for you. I don't have sample data to verify that.

0 Karma

DougiieDee
Explorer

1. {\"errors\":[{\"code\"😕"ABC-1000\",\"message\"😕"Sorry we are unable to process your request.

index=abc  ABC-*
|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)" | where ABC_Code!="" | search ABC_Code=* | Stats count by ABC_Code Message

2. exception:CommonApplicationException ABC_1001:We're sorry, it looks like an error occured

index=abc "exception":"CommonApplicationException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| eval Message=substr(Message, 1, 140)
| stats count by ABC_CODE, Message

I have these two rex and want to combine both but because these two are different is it possible to combine them and have Stats count by ABC_Code Message?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval parts=split(field,":")
| eval message=mvindex(parts,2)
0 Karma

DougiieDee
Explorer

this doesnt work, could you please give another solutions?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry that should have been

| eval parts=split(field,":")
| eval message=mvindex(parts,3)

If this doesn't work, can you provide more complete example event (anonymised) and details of what fields you already have extracted to help us find a better solution

0 Karma

DougiieDee
Explorer

index=abc 
"exception":"java.util.concurrent.ExecutionException"

searching above displays like these in below events

"exception":"java.util.concurrent.ExecutionException: ABC_1000:We're sorryit looks like an error occurred while getting information"

"exception":"java.util.concurrent.ExecutionException: ABC-2000:We're sorry, it looks like an error occurred while getting information"

I want to take the ABC_ OR ABC- error codes and have a report based on that which should look like this

ABC Codesmessagecounts
ABC_1000We're sorryit looks like an error occurred while getting information3
ABC-2000We're sorry, it looks like an error occurred while getting information5

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=fieldX "(?<ABCcode>ABC(_|-)\d+):(?<message>.*?)"
0 Karma

DougiieDee
Explorer

didnt work with this rex query

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Perhaps this will work?

| rex field=fieldX "(?<ABCcode>ABC(_|\-)\d+):(?<message>.*?)"
0 Karma

mikeyty07
Communicator
this is same as the above didnt work
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Rather than me guessing what your events actually look like and what your current search looks like with respect to fields already extracted, perhaps you can provide some more detail?

0 Karma

DougiieDee
Explorer

2021-06-09 15:00:37.640  ThreadCompletableFuture : {"logType":"STANDARD","message":"Exception occurred executing task","context":{"configLabel":"abc-session-4.0-372","threadContextId":"2e63fe-83f"},"exception":"java.util.concurrent.ExecutionException: CommonApplicationException: ABC_2004:We're sorry, it looks like an error occurred while retrieving information


2021-06-09 15:00:37.640  ThreadCompletableFuture : {"logType":"STANDARD","message":"Exception occurred executing task","context":{"configLabel":"abc-session-4.0-372","threadContextId":"2e63fe-83f"},"exception":"java.util.concurrent.ExecutionException: CommonApplicationException: ABC-2014:We're sorry, it looks like an error occurred while retrieving information

it looks sth like this and i want the abc code and message

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<errorCode>ABC(_|\-)\d+):(?<errorMessage>.*)"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...