Splunk Search

Extract exception message ignoring numbers/GUIDs

hbazan
Path Finder

Hi,
I need to make a ranking of most common exception messages, from different services. I've been able to extract the exception messages using rex, but several values include numbers or GUIDs.
Examples:
- the CronopioId=123455 is invalid
- couldn't find a Fama associated to CronopioId=123455 and EsperanzaId=658d3cd9-4259-4824-878c-27d33b6af743 with status=Valid

What I need is to extract the message without numbers or guids, but the rest of the message.
I'm using this for the GUIDs, but it only work with one GUID in the whole sentence:

rex field=PreGUID "(?.*)({{0,1}([0-9]){8}-([0-9]){6}-([0-9]){3}}{0,1})" | eval ExceptionMessage=if(NOT isnull(PostGUID),PreGUID+" ? "+PostGUID,if(NOT isnull(PreGUID), PreGUID, ExceptionMessage))

Is there a simpler way?

Tags (2)
0 Karma
1 Solution

cphair
Builder

Use sed in global replace mode (note the g at the end of the line) to do multiple substitutions. Something like the following should generalize your GUIDS--you'll have to edit for whatever the proper matching regex should be. If there's a specific pattern to the other numbers/process IDs you want to eliminate, you can run a second rex to get rid of those, but be careful you don't match more than you intend.

rex mode=sed "s/[0-9a-f]{8}-[0-9a-f]{6}-[0-9a-f]{3}/xxxxxxxx-xxxxxx-xxx/g"

View solution in original post

cphair
Builder

Use sed in global replace mode (note the g at the end of the line) to do multiple substitutions. Something like the following should generalize your GUIDS--you'll have to edit for whatever the proper matching regex should be. If there's a specific pattern to the other numbers/process IDs you want to eliminate, you can run a second rex to get rid of those, but be careful you don't match more than you intend.

rex mode=sed "s/[0-9a-f]{8}-[0-9a-f]{6}-[0-9a-f]{3}/xxxxxxxx-xxxxxx-xxx/g"

cphair
Builder

Thanks for the regex correction. Glad it worked for you.

0 Karma

hbazan
Path Finder

Great!. In case someone else is looking for this, the expression does not match a GUID. This one does:
rex mode=sed "s/({{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}}{0,1})/xxxxxxxx-xxxxxx-xxx/g"

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...