Splunk Search

Extract Error Message String

mkulicke
Explorer

I am trying to extract the messages of a commonly used error log:

 

Creating review recommendations service case activity with errorMessage:  example message one here

Creating review recommendations service case activity with errorMessage:  example message two over here 

 

I want to do some graphing of counts of the totals of each individual message, so would like to extract the string and stats count by message. Having trouble extracting the string. How do I do this cleanly? The goal would be to have results for

"example message one here" :  X number of results

"example message two over here": Y number of results

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can use the rex command to extract the message text into a field and then use stats to count them.

... | rex "errorMessage: (?<message>.*)"
| stats count by message

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can use the rex command to extract the message text into a field and then use stats to count them.

... | rex "errorMessage: (?<message>.*)"
| stats count by message

 

---
If this reply helps you, Karma would be appreciated.

mkulicke
Explorer

Perfect, thank you. I was just having trouble extracting the full sentence with my regex, but this solved it perfectly.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...