How do you use the rex command to extract a certain error?

[pranay04]

I am trying to extract a certain error and then plot in on an are chart using rex. Below is the error I am looking for in logs :

Error : Request processing failed; nested exception is com.unionbank.banking.exception.BankingRuntimeException: HRTMap : HRTMap

The query I am using is :

index=xxx host=*prd* source= *yyy* "HRTMap"  | eval Date=strftime(_time, "%m-%d-%Y") | eval Time=strftime(_time, "%H:%M:%S") |rex "HRTMap: (?\w+)" | timechart count(HRTMapError) as HRT

but I am not getting a result for that.

[chrisyounger · Accepted solution]

Try this:

index=xxx host=prd source= yyy "HRTMap" | eval Date=strftime(_time, "%m-%d-%Y") | eval Time=strftime(_time, "%H:%M:%S") |rex "HRTMap\s*:\s*(?<HRTMapError>\w+)" | timechart count(HRTMapError) as HRT

You can also use |timechart dc(HRTMapError) as HRT to get the distinct count of error messages.

Hope it helps