Splunk Search

How do you extract a string within a longer string using regex?

BenzionYunger
New Member

I have an event that has a key-value output, and I need to extract the random string within the long string, for example, if my output string was "java.lang.RuntimeException: {Here is my random string} at com.quantum.myApp bla bla bla .....". How can I format the output to capture my random string. I've tried replace and rex unsuccessfully but it could be I did it wrong.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

The suggestion did not work, I initially needed to remove the first pipe before 'makeresults' because Splunk was complaining, but afterwards nothing showed up in the results.
No. that first pipe is needed for makeresults command.
The makeresults command is a generating command and should be the first command in the search. Generating commands use a leading pipe character.
https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Makeresults

@whrg command works fine.. please check the screenshot:
| makeresults count=1
| eval _raw="java.lang.RuntimeException: {Here is my random string} at com.quantum.myApp bla bla bla"
| rex field=_raw "java\.lang\.RuntimeException:\s+\{(?[^\}]+)"

alt text

(PS - please accept @whrg 's answer as the accepted answer.. you can upvote this answer 😉 )

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @BenzionYunger,

Did you have a chance to check out whrg's answer? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya.

Thanks for posting!

0 Karma

whrg
Motivator

Check out this regex:

java\.lang\.RuntimeException:\s+\{(?<Exception>[^\}]+)

Here you can see it in action:

| makeresults count=1
| eval _raw="java.lang.RuntimeException: {Here is my random string} at com.quantum.myApp bla bla bla"
| rex field=_raw "java\.lang\.RuntimeException:\s+\{(?<Exception>[^\}]+)"

Now there is a new field named "Exception" with the value "Here is my random string".

BenzionYunger
New Member

The suggestion did not work, I initially needed to remove the first pipe before 'makeresults' because Splunk was complaining, but afterwards nothing showed up in the results. My only guess is the raw expression is a randomly long string and I'm cutting if off after the first 12 words, I tried adding a wildcard at the end, but it didn't help. Maybe something needs to be refined. Here is the code I tried:
index="myIndex" makeresults count=1
| eval _raw="java.lang.RuntimeException: Sign in error message at com.quantum"
| rex field=_raw "java\.lang\.RuntimeException:\s+\{(?[^\}]+)"

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...