Splunk Search

How to correct my regex to extract text from two or more lines?

Bhuavana
Explorer

Hi,

Please let me know the regex to extract text from 2 or 3 more lines.

For below log text :

ClientIp=065162175003 : - Exception while getting fileApolloWhitelistedCredentials.properties ResourceHandler:getConfirationProperties() 
java.io.FileNotFoundException: /apps/mobiliser5.1.0/02/money/conf/ApolloWhitelistedCredentials.properties (No such file or directory)
 at 

I have used the below regex but it extracts text [from-- Exception while getting] and [till-- getConfirationProperties()] but text at next line[java.io.FileNotFoundException --> is not appended] to the field exception_msg.

| rex field=_raw "ClientIp=d{12} :  -(?(.*)+[\n at]\n)"

Kindly let me know the correct regex to extract text starting from [Exception..... ]till [(No such file or directory)]

Tags (2)
0 Karma

Venkat_16
Contributor

hi Bhuavana,

   ClientIp=\d{12}\s\:\s\-\s(?P<msg>(.|\r)+?)\(No\ssuch\sfile\sor\sdirectory\)

       please try this...

Thanks,
Venkat

MuS
SplunkTrust
SplunkTrust

Hi Bhuavana,

try something like this:

your base search here | rex field=_raw "ClientIp=\d{12}\s\:\s\-\s(?<myMsg>(?s).*)\(No\ssuch\sfile\sor\sdirectory\)" | table myMsg

cheers, MuS

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...