Splunk Search

Help with REGEX to create field extraction

joesrepsolc
Communicator

Looking to find this value for "java.net.SocketException" and populate a new field in Splunk's interesting fields. Getting better at regex but still missing the final pieces to make this work. How to i take the string "Too many open files" and create a new interesting field named "SocketException". Could have many different values. There is also a character return after this line, so I need the value after the colon and space, to the end of the line. Should be "Too many open files" in this example

EXAMPLE OF LOG
at java.lang.Thread.run(Thread.java:748)
Caused by: java.net.SocketException: Too many open files
at java.net.Socket.createImpl(Socket.java:460)

WHAT I HAVE SO FAR:

>regex:  java\.net\.SocketException:\s

Thanks so much! - Joe

0 Karma
1 Solution

rbechtold
Communicator

Hey Joe,

Give this regex a try for me:

java\.net\.SocketException\:\s(?<SocketException>[^\n]+)

In order to capture everything until the newline, we're using something called a negated character set. If you're curious about how it works, check this link out - https://www.regular-expressions.info/charclass.html

Let me know if this extraction doesn't work for you and I'll try to help fix it!

View solution in original post

rbechtold
Communicator

Hey Joe,

Give this regex a try for me:

java\.net\.SocketException\:\s(?<SocketException>[^\n]+)

In order to capture everything until the newline, we're using something called a negated character set. If you're curious about how it works, check this link out - https://www.regular-expressions.info/charclass.html

Let me know if this extraction doesn't work for you and I'll try to help fix it!

joesrepsolc
Communicator

That worked perfectly! Thanks so much for the help, and the link. I will definitely check this out. Regex skills definitely need to be improved, but this is awesome!

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...