Splunk Search

How can I rex on an exact error code?

splgeek
Explorer

Hello ppl
I have a set of Error messages in an event log that looks like this
ERROR [43f796d8da] there are several codes like this in the events, so i don't want to miss out extracting them

What would be the rex command so that I could extract the Error codes and assign it to a field called Errortype?

0 Karma
1 Solution

gokadroid
Motivator

If the error code exists once in every log event then try these please:

1) If you want the ERROR word and square brackets in the string as well:

yourBaseSearch
| rex "(?<Errortype>ERROR\s\[[^\]]+\])"
| complete your query using Errortype field

See result here

2) If you only want only the code within the brackets, try:

yourBaseSearch
| rex "ERROR\s\[(?<Errortype>[^\]]+)\]"
| complete your query using Errortype field

See results here

View solution in original post

ehudb
Contributor
|rex "\w+\s\[(?<Errortype>[^\]]+)]"

Explanation:
A. Word with one or more letter
B. one or more space
C. starting bracket '['
D. One or more Non-Closing bracket ']' character (will be the field value)
E. Closing bracket ']'

0 Karma

gokadroid
Motivator

If the error code exists once in every log event then try these please:

1) If you want the ERROR word and square brackets in the string as well:

yourBaseSearch
| rex "(?<Errortype>ERROR\s\[[^\]]+\])"
| complete your query using Errortype field

See result here

2) If you only want only the code within the brackets, try:

yourBaseSearch
| rex "ERROR\s\[(?<Errortype>[^\]]+)\]"
| complete your query using Errortype field

See results here

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!