Splunk Search

Help needed in extracting string between two similar strings

Nadal7noval
New Member

I have a log mentioned below:

ERROR: Cannot retrieve requested details in 103 ms cause: [50000] ERROR: Building profile failed in 103 ms cause: [000026] ERROR: Cannot build requested profile in 99 ms cause: [5100007] ERROR: Cannot get details for ID : [[ ID ]] cause: Retrieve details failure cause:

I need to extract the string that starts from 1st "ERROR:" to 2nd "cause:" word.
I am using rex field=_raw "(?ERROR.*)cause:"
It is giving me complete string till the last cause. Can you help me with rex to stop at 2nd cause:

Expected result:
ERROR: Cannot retrieve requested details in 103 ms cause: [50000] ERROR: Building profile failed in 103 ms

Tags (2)
0 Karma

jincy_18
Path Finder

Hi Nadal7noval,

You can try below:

(?<ERROR>(ERROR:.+?){2})(?=cause\:\s\[)

OR

(?<ERROR>(ERROR:.+?){2})(?=cause\:)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Nadal7noval,
try this

(?<ERROR>(ERROR:.*cause:\s\[\d+\]\s+){2})

or

| rex "(?<ERROR>(ERROR:.*cause:\s\[\d+\]\s+){2})"

test it at https://regex101.com/r/rrhW1y/1

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...