Splunk Search

How Can I extraxt specific string part of app logs?

iqbalintouch
Path Finder

This is the text which is being print in our app logs :
throws abc.xyz.error.AppException,java.rmi.RemoteException, with 1 error(s): [Error in object 'MyAccountRQ': codes [Password must not contain spaces and must have 6-30 characters.MyAccountRQ,Password must not contain spaces and must have 6-30 characters];

the text in the [text] bracket could be different errors, I need to print it as" codes [] " in format.
Can anyone please help I tried with simple search query with but that doesn't serves the purpose.

Please help, I am a learner of splunk.

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval test="throws abc.xyz.error.AppException,java.rmi.RemoteException, with 1 error(s): [Error in object 'MyAccountRQ': codes [Password must not contain spaces and must have 6-30 characters.MyAccountRQ,Password must not contain spaces and must have 6-30 characters];" 
| rex field=test "codes\s+\[(?P<Codes>[^\]]+)"
0 Karma
Get Updates on the Splunk Community!

Unleash the Power of Splunk MCP and AI, Meet Us at .Conf 2025, and Find Even More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Professionals: Build Resilience and Visibility with These .conf25 ...

  If you're focused on performance, availability, and full-stack visibility, the Observability track at ...

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...