Splunk Search

Help with REGEX to create field extraction

joesrepsolc
Communicator

Looking to find this value for "java.net.SocketException" and populate a new field in Splunk's interesting fields. Getting better at regex but still missing the final pieces to make this work. How to i take the string "Too many open files" and create a new interesting field named "SocketException". Could have many different values. There is also a character return after this line, so I need the value after the colon and space, to the end of the line. Should be "Too many open files" in this example

EXAMPLE OF LOG
at java.lang.Thread.run(Thread.java:748)
Caused by: java.net.SocketException: Too many open files
at java.net.Socket.createImpl(Socket.java:460)

WHAT I HAVE SO FAR:

>regex:  java\.net\.SocketException:\s

Thanks so much! - Joe

0 Karma
1 Solution

rbechtold
Communicator

Hey Joe,

Give this regex a try for me:

java\.net\.SocketException\:\s(?<SocketException>[^\n]+)

In order to capture everything until the newline, we're using something called a negated character set. If you're curious about how it works, check this link out - https://www.regular-expressions.info/charclass.html

Let me know if this extraction doesn't work for you and I'll try to help fix it!

View solution in original post

rbechtold
Communicator

Hey Joe,

Give this regex a try for me:

java\.net\.SocketException\:\s(?<SocketException>[^\n]+)

In order to capture everything until the newline, we're using something called a negated character set. If you're curious about how it works, check this link out - https://www.regular-expressions.info/charclass.html

Let me know if this extraction doesn't work for you and I'll try to help fix it!

joesrepsolc
Communicator

That worked perfectly! Thanks so much for the help, and the link. I will definitely check this out. Regex skills definitely need to be improved, but this is awesome!

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...