Splunk Search

Extract raw data using rex

ninadmnaik
Explorer

I want to extract exception, key and message from a raw event in our logs. The event looks like:

EXCEPTION - : TypeOfException : keyprefix.keyName : Message from web service

From the event I use REX to get the following:

exception=TypeOfException
key=keyprefix.keyName
message=Message from web service

I am using the following rex for it:

rex field=_raw "EXCEPTION - : (?\w+) : (?\w+) : (?\w+)"

But this isn't working. Can you guys point me in the right direction?
I have tried various combinations of these inserting spaces (\s) where we see spaces in the event.

Tags (2)
0 Karma
1 Solution

ninadmnaik
Explorer

Ok. Found the answer:
rex field=_raw "EXCEPTION\s-\s\s:(?[\s\w]+): (?\w+.\w+) : (?[\w\s]+)"

View solution in original post

ninadmnaik
Explorer

Ok. Found the answer:
rex field=_raw "EXCEPTION\s-\s\s:(?[\s\w]+): (?\w+.\w+) : (?[\w\s]+)"

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...