Splunk Search

How can I rex on an exact error code?

splgeek
Explorer

Hello ppl
I have a set of Error messages in an event log that looks like this
ERROR [43f796d8da] there are several codes like this in the events, so i don't want to miss out extracting them

What would be the rex command so that I could extract the Error codes and assign it to a field called Errortype?

0 Karma
1 Solution

gokadroid
Motivator

If the error code exists once in every log event then try these please:

1) If you want the ERROR word and square brackets in the string as well:

yourBaseSearch
| rex "(?<Errortype>ERROR\s\[[^\]]+\])"
| complete your query using Errortype field

See result here

2) If you only want only the code within the brackets, try:

yourBaseSearch
| rex "ERROR\s\[(?<Errortype>[^\]]+)\]"
| complete your query using Errortype field

See results here

View solution in original post

ehudb
Contributor
|rex "\w+\s\[(?<Errortype>[^\]]+)]"

Explanation:
A. Word with one or more letter
B. one or more space
C. starting bracket '['
D. One or more Non-Closing bracket ']' character (will be the field value)
E. Closing bracket ']'

0 Karma

gokadroid
Motivator

If the error code exists once in every log event then try these please:

1) If you want the ERROR word and square brackets in the string as well:

yourBaseSearch
| rex "(?<Errortype>ERROR\s\[[^\]]+\])"
| complete your query using Errortype field

See result here

2) If you only want only the code within the brackets, try:

yourBaseSearch
| rex "ERROR\s\[(?<Errortype>[^\]]+)\]"
| complete your query using Errortype field

See results here

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...