Splunk Search

How can I rex on an exact error code?

splgeek
Explorer

Hello ppl
I have a set of Error messages in an event log that looks like this
ERROR [43f796d8da] there are several codes like this in the events, so i don't want to miss out extracting them

What would be the rex command so that I could extract the Error codes and assign it to a field called Errortype?

0 Karma
1 Solution

gokadroid
Motivator

If the error code exists once in every log event then try these please:

1) If you want the ERROR word and square brackets in the string as well:

yourBaseSearch
| rex "(?<Errortype>ERROR\s\[[^\]]+\])"
| complete your query using Errortype field

See result here

2) If you only want only the code within the brackets, try:

yourBaseSearch
| rex "ERROR\s\[(?<Errortype>[^\]]+)\]"
| complete your query using Errortype field

See results here

View solution in original post

ehudb
Contributor
|rex "\w+\s\[(?<Errortype>[^\]]+)]"

Explanation:
A. Word with one or more letter
B. one or more space
C. starting bracket '['
D. One or more Non-Closing bracket ']' character (will be the field value)
E. Closing bracket ']'

0 Karma

gokadroid
Motivator

If the error code exists once in every log event then try these please:

1) If you want the ERROR word and square brackets in the string as well:

yourBaseSearch
| rex "(?<Errortype>ERROR\s\[[^\]]+\])"
| complete your query using Errortype field

See result here

2) If you only want only the code within the brackets, try:

yourBaseSearch
| rex "ERROR\s\[(?<Errortype>[^\]]+)\]"
| complete your query using Errortype field

See results here

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...