Splunk Search

Case insensitive search in rex

Naren26
Path Finder

I am having a field such as Exception: NullReferenceException. And sometimes, EXCEPTION:NullReferenceExcpetion.

I need to capture the exception type with single rex command. I used the following rex, but it is not working:

rex "(?!)Exception:(?<ErrorType>.*)"

What am I doing wrong here? Is it possible to achieve? Kindly advice.

0 Karma
1 Solution

mayurr98
Super Champion

hey @Naren26
I think you have mistakenly written ! instead of i.
Your regex is correct just change (?!) with (?i)

So your regex would be

rex "(?i)Exception:(?<ErrorType>.*)"

let me know if this helps!

View solution in original post

mayurr98
Super Champion

hey @Naren26
I think you have mistakenly written ! instead of i.
Your regex is correct just change (?!) with (?i)

So your regex would be

rex "(?i)Exception:(?<ErrorType>.*)"

let me know if this helps!

Naren26
Path Finder

Oh my!! Such a silly mistake. Thanks for picking it up.

tiagofbmm
Influencer

Hey

Here is your regex | rex field=t "(?i)Exception(?<lalal>.*)"

Try it in this generic example please:

| makeresults 
| eval t="Exception_asdasd" | append [ | makeresults | eval t="EXCEPTION_asdasd"]
| rex field=t "(?i)Exception(?<lalal>.*)"
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...