Splunk Search

How to correct my regex to extract text from two or more lines?

Bhuavana
Explorer

Hi,

Please let me know the regex to extract text from 2 or 3 more lines.

For below log text :

ClientIp=065162175003 : - Exception while getting fileApolloWhitelistedCredentials.properties ResourceHandler:getConfirationProperties() 
java.io.FileNotFoundException: /apps/mobiliser5.1.0/02/money/conf/ApolloWhitelistedCredentials.properties (No such file or directory)
 at 

I have used the below regex but it extracts text [from-- Exception while getting] and [till-- getConfirationProperties()] but text at next line[java.io.FileNotFoundException --> is not appended] to the field exception_msg.

| rex field=_raw "ClientIp=d{12} :  -(?(.*)+[\n at]\n)"

Kindly let me know the correct regex to extract text starting from [Exception..... ]till [(No such file or directory)]

Tags (2)
0 Karma

Venkat_16
Contributor

hi Bhuavana,

   ClientIp=\d{12}\s\:\s\-\s(?P<msg>(.|\r)+?)\(No\ssuch\sfile\sor\sdirectory\)

       please try this...

Thanks,
Venkat

MuS
Legend

Hi Bhuavana,

try something like this:

your base search here | rex field=_raw "ClientIp=\d{12}\s\:\s\-\s(?<myMsg>(?s).*)\(No\ssuch\sfile\sor\sdirectory\)" | table myMsg

cheers, MuS

Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...