Case insensitive search in rex

[Naren26]

I am having a field such as Exception: NullReferenceException. And sometimes, EXCEPTION:NullReferenceExcpetion.

I need to capture the exception type with single rex command. I used the following rex, but it is not working:

rex "(?!)Exception:(?<ErrorType>.*)"

What am I doing wrong here? Is it possible to achieve? Kindly advice.

[mayurr98 · Accepted solution]

hey @Naren26
I think you have mistakenly written ! instead of i.
Your regex is correct just change (?!) with (?i)

So your regex would be

rex "(?i)Exception:(?<ErrorType>.*)"

let me know if this helps!

[Naren26]

Oh my!! Such a silly mistake. Thanks for picking it up.

[tiagofbmm]

Hey

Here is your regex | rex field=t "(?i)Exception(?<lalal>.*)"

Try it in this generic example please:

| makeresults 
| eval t="Exception_asdasd" | append [ | makeresults | eval t="EXCEPTION_asdasd"]
| rex field=t "(?i)Exception(?<lalal>.*)"