Splunk Search

Help with REGEX to create field extraction

joesrepsolc
Communicator

Looking to find this value for "java.net.SocketException" and populate a new field in Splunk's interesting fields. Getting better at regex but still missing the final pieces to make this work. How to i take the string "Too many open files" and create a new interesting field named "SocketException". Could have many different values. There is also a character return after this line, so I need the value after the colon and space, to the end of the line. Should be "Too many open files" in this example

EXAMPLE OF LOG
at java.lang.Thread.run(Thread.java:748)
Caused by: java.net.SocketException: Too many open files
at java.net.Socket.createImpl(Socket.java:460)

WHAT I HAVE SO FAR:

>regex:  java\.net\.SocketException:\s

Thanks so much! - Joe

0 Karma
1 Solution

rbechtold
Communicator

Hey Joe,

Give this regex a try for me:

java\.net\.SocketException\:\s(?<SocketException>[^\n]+)

In order to capture everything until the newline, we're using something called a negated character set. If you're curious about how it works, check this link out - https://www.regular-expressions.info/charclass.html

Let me know if this extraction doesn't work for you and I'll try to help fix it!

View solution in original post

rbechtold
Communicator

Hey Joe,

Give this regex a try for me:

java\.net\.SocketException\:\s(?<SocketException>[^\n]+)

In order to capture everything until the newline, we're using something called a negated character set. If you're curious about how it works, check this link out - https://www.regular-expressions.info/charclass.html

Let me know if this extraction doesn't work for you and I'll try to help fix it!

joesrepsolc
Communicator

That worked perfectly! Thanks so much for the help, and the link. I will definitely check this out. Regex skills definitely need to be improved, but this is awesome!

Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...