I am having a field such as Exception: NullReferenceException
. And sometimes, EXCEPTION:NullReferenceExcpetion
.
I need to capture the exception type with single rex command. I used the following rex, but it is not working:
rex "(?!)Exception:(?<ErrorType>.*)"
What am I doing wrong here? Is it possible to achieve? Kindly advice.
hey @Naren26
I think you have mistakenly written !
instead of i
.
Your regex is correct just change (?!)
with (?i)
So your regex would be
rex "(?i)Exception:(?<ErrorType>.*)"
let me know if this helps!
hey @Naren26
I think you have mistakenly written !
instead of i
.
Your regex is correct just change (?!)
with (?i)
So your regex would be
rex "(?i)Exception:(?<ErrorType>.*)"
let me know if this helps!
Oh my!! Such a silly mistake. Thanks for picking it up.
Hey
Here is your regex | rex field=t "(?i)Exception(?<lalal>.*)"
Try it in this generic example please:
| makeresults
| eval t="Exception_asdasd" | append [ | makeresults | eval t="EXCEPTION_asdasd"]
| rex field=t "(?i)Exception(?<lalal>.*)"