Splunk Search

How Can I extraxt specific string part of app logs?

iqbalintouch
Path Finder

This is the text which is being print in our app logs :
throws abc.xyz.error.AppException,java.rmi.RemoteException, with 1 error(s): [Error in object 'MyAccountRQ': codes [Password must not contain spaces and must have 6-30 characters.MyAccountRQ,Password must not contain spaces and must have 6-30 characters];

the text in the [text] bracket could be different errors, I need to print it as" codes [] " in format.
Can anyone please help I tried with simple search query with but that doesn't serves the purpose.

Please help, I am a learner of splunk.

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval test="throws abc.xyz.error.AppException,java.rmi.RemoteException, with 1 error(s): [Error in object 'MyAccountRQ': codes [Password must not contain spaces and must have 6-30 characters.MyAccountRQ,Password must not contain spaces and must have 6-30 characters];" 
| rex field=test "codes\s+\[(?P<Codes>[^\]]+)"
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...