Splunk Search

Help needed in extracting string between two similar strings

Nadal7noval
New Member

I have a log mentioned below:

ERROR: Cannot retrieve requested details in 103 ms cause: [50000] ERROR: Building profile failed in 103 ms cause: [000026] ERROR: Cannot build requested profile in 99 ms cause: [5100007] ERROR: Cannot get details for ID : [[ ID ]] cause: Retrieve details failure cause:

I need to extract the string that starts from 1st "ERROR:" to 2nd "cause:" word.
I am using rex field=_raw "(?ERROR.*)cause:"
It is giving me complete string till the last cause. Can you help me with rex to stop at 2nd cause:

Expected result:
ERROR: Cannot retrieve requested details in 103 ms cause: [50000] ERROR: Building profile failed in 103 ms

Tags (2)
0 Karma

jincy_18
Path Finder

Hi Nadal7noval,

You can try below:

(?<ERROR>(ERROR:.+?){2})(?=cause\:\s\[)

OR

(?<ERROR>(ERROR:.+?){2})(?=cause\:)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Nadal7noval,
try this

(?<ERROR>(ERROR:.*cause:\s\[\d+\]\s+){2})

or

| rex "(?<ERROR>(ERROR:.*cause:\s\[\d+\]\s+){2})"

test it at https://regex101.com/r/rrhW1y/1

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...