Splunk rex field

[DougiieDee]

How do i extract this message in splunk rex field to display error code and message in reports like ABC_Code and Message?
"exception":"java.util.concurrent.ExecutionException: ABC_1000:We're sorry, it looks like an error occurred while getting information"

[pavanbmishra]

\"exception\"\:\"\w+\.\w+\.\w+\.\w+\:\s+(?P<CODE>.*)\:(?<message>.*)\"

[rupkumar4sec]

Try below regular expression

|rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"

Assuming your message ends with double quotes(")

[DougiieDee]

didnt work for this as well shows all the logs

[rupkumar4sec · Accepted solution]

Yeah it is just a rex command so it will show raw events. If you want a table like you asked in  one of your comments use below search 

index=abc "exception":"java.util.concurrent.ExecutionException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| stats count by  ABC_CODE, Message

[DougiieDee]

this looks good but is there a way to minimize message to limited text instead of whole events error?

[rupkumar4sec]

You use an eval command with substr function to get a part of that message.

Example: To get first 10 letters

| eval Message=substr(Message, 1, 10)

I hope I understood what you are looking for.

[DougiieDee]

this looks better. how do i add another exception here with "exception":"ExecutionException" in below. so there will be two. 
index=abc "exception":"CommonApplicationException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| eval Message=substr(Message, 1, 140)
| stats count by ABC_CODE, Message

Also how to add this same rex field there?

ABC-* |rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)" | where ABC_Code!="" | search ABC_Code=* | stats count by ABC_CODE, Message

[rupkumar4sec]

index=abc ("exception":"CommonApplicationException" OR "exception":"ExecutionException")
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)"
| eval Message=substr(Message, 1, 140)
| stats count by ABC_CODE, Message

Added your other key word and regular expression. I hope that new regular expression is working for you. I don't have sample data to verify that.

[DougiieDee]

1. {\"errors\":[{\"code\"😕"ABC-1000\",\"message\"😕"Sorry we are unable to process your request.

index=abc  ABC-*
|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)" | where ABC_Code!="" | search ABC_Code=* | Stats count by ABC_Code Message

2. exception:CommonApplicationException ABC_1001:We're sorry, it looks like an error occured

index=abc "exception":"CommonApplicationException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| eval Message=substr(Message, 1, 140)
| stats count by ABC_CODE, Message

I have these two rex and want to combine both but because these two are different is it possible to combine them and have Stats count by ABC_Code Message?

[ITWhisperer]

| eval parts=split(field,":")
| eval message=mvindex(parts,2)

[DougiieDee]

this doesnt work, could you please give another solutions?

[ITWhisperer]

Sorry that should have been

| eval parts=split(field,":")
| eval message=mvindex(parts,3)

If this doesn't work, can you provide more complete example event (anonymised) and details of what fields you already have extracted to help us find a better solution

[DougiieDee]

index=abc 
"exception":"java.util.concurrent.ExecutionException"

searching above displays like these in below events

"exception":"java.util.concurrent.ExecutionException: ABC_1000:We're sorry, it looks like an error occurred while getting information"

"exception":"java.util.concurrent.ExecutionException: ABC-2000:We're sorry, it looks like an error occurred while getting information"

I want to take the ABC_ OR ABC- error codes and have a report based on that which should look like this

ABC Codes	message	counts
ABC_1000	We're sorry, it looks like an error occurred while getting information	3
ABC-2000	We're sorry, it looks like an error occurred while getting information	5

[ITWhisperer]

| rex field=fieldX "(?<ABCcode>ABC(_|-)\d+):(?<message>.*?)"

[DougiieDee]

didnt work with this rex query

[ITWhisperer]

Perhaps this will work?

| rex field=fieldX "(?<ABCcode>ABC(_|\-)\d+):(?<message>.*?)"

[mikeyty07]

this is same as the above didnt work

[ITWhisperer]

Rather than me guessing what your events actually look like and what your current search looks like with respect to fields already extracted, perhaps you can provide some more detail?

[DougiieDee]

2021-06-09 15:00:37.640  ThreadCompletableFuture : {"logType":"STANDARD","message":"Exception occurred executing task","context":{"configLabel":"abc-session-4.0-372","threadContextId":"2e63fe-83f"},"exception":"java.util.concurrent.ExecutionException: CommonApplicationException: ABC_2004:We're sorry, it looks like an error occurred while retrieving information

2021-06-09 15:00:37.640  ThreadCompletableFuture : {"logType":"STANDARD","message":"Exception occurred executing task","context":{"configLabel":"abc-session-4.0-372","threadContextId":"2e63fe-83f"},"exception":"java.util.concurrent.ExecutionException: CommonApplicationException: ABC-2014:We're sorry, it looks like an error occurred while retrieving information

it looks sth like this and i want the abc code and message

[ITWhisperer]

| rex "(?<errorCode>ABC(_|\-)\d+):(?<errorMessage>.*)"