Splunk Search

How Can I extraxt specific string part of app logs?

Path Finder

This is the text which is being print in our app logs :
throws abc.xyz.error.AppException,java.rmi.RemoteException, with 1 error(s): [Error in object 'MyAccountRQ': codes [Password must not contain spaces and must have 6-30 characters.MyAccountRQ,Password must not contain spaces and must have 6-30 characters];

the text in the [text] bracket could be different errors, I need to print it as" codes [] " in format.
Can anyone please help I tried with simple search query with but that doesn't serves the purpose.

Please help, I am a learner of splunk.

0 Karma

Champion

Hi

Try this

| makeresults 
| eval test="throws abc.xyz.error.AppException,java.rmi.RemoteException, with 1 error(s): [Error in object 'MyAccountRQ': codes [Password must not contain spaces and must have 6-30 characters.MyAccountRQ,Password must not contain spaces and must have 6-30 characters];" 
| rex field=test "codes\s+\[(?P<Codes>[^\]]+)"
0 Karma