Splunk Search

Help with REGEX to create field extraction

joesrepsolc
Communicator

Looking to find this value for "java.net.SocketException" and populate a new field in Splunk's interesting fields. Getting better at regex but still missing the final pieces to make this work. How to i take the string "Too many open files" and create a new interesting field named "SocketException". Could have many different values. There is also a character return after this line, so I need the value after the colon and space, to the end of the line. Should be "Too many open files" in this example

EXAMPLE OF LOG
at java.lang.Thread.run(Thread.java:748)
Caused by: java.net.SocketException: Too many open files
at java.net.Socket.createImpl(Socket.java:460)

WHAT I HAVE SO FAR:

>regex:  java\.net\.SocketException:\s

Thanks so much! - Joe

0 Karma
1 Solution

rbechtold
Communicator

Hey Joe,

Give this regex a try for me:

java\.net\.SocketException\:\s(?<SocketException>[^\n]+)

In order to capture everything until the newline, we're using something called a negated character set. If you're curious about how it works, check this link out - https://www.regular-expressions.info/charclass.html

Let me know if this extraction doesn't work for you and I'll try to help fix it!

View solution in original post

rbechtold
Communicator

Hey Joe,

Give this regex a try for me:

java\.net\.SocketException\:\s(?<SocketException>[^\n]+)

In order to capture everything until the newline, we're using something called a negated character set. If you're curious about how it works, check this link out - https://www.regular-expressions.info/charclass.html

Let me know if this extraction doesn't work for you and I'll try to help fix it!

joesrepsolc
Communicator

That worked perfectly! Thanks so much for the help, and the link. I will definitely check this out. Regex skills definitely need to be improved, but this is awesome!

Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...