Splunk Search

Case insensitive search in rex

Naren26
Path Finder

I am having a field such as Exception: NullReferenceException. And sometimes, EXCEPTION:NullReferenceExcpetion.

I need to capture the exception type with single rex command. I used the following rex, but it is not working:

rex "(?!)Exception:(?<ErrorType>.*)"

What am I doing wrong here? Is it possible to achieve? Kindly advice.

0 Karma
1 Solution

mayurr98
Super Champion

hey @Naren26
I think you have mistakenly written ! instead of i.
Your regex is correct just change (?!) with (?i)

So your regex would be

rex "(?i)Exception:(?<ErrorType>.*)"

let me know if this helps!

View solution in original post

mayurr98
Super Champion

hey @Naren26
I think you have mistakenly written ! instead of i.
Your regex is correct just change (?!) with (?i)

So your regex would be

rex "(?i)Exception:(?<ErrorType>.*)"

let me know if this helps!

Naren26
Path Finder

Oh my!! Such a silly mistake. Thanks for picking it up.

tiagofbmm
Influencer

Hey

Here is your regex | rex field=t "(?i)Exception(?<lalal>.*)"

Try it in this generic example please:

| makeresults 
| eval t="Exception_asdasd" | append [ | makeresults | eval t="EXCEPTION_asdasd"]
| rex field=t "(?i)Exception(?<lalal>.*)"
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...