Splunk Search

How to create regular expressions for these Exceptions?

jw44250
New Member

I want to know how can i create regular expressions for the following exceptions...

java.io.IOException

java.lang.Exception

java.lang.IllegalAccessException

java.lang.reflect.InvocationTargetException
java.lang.RuntimeException
java.net.ConnectException,
java.net.SocketException
java.rmi.NoSuchObjectException

java.util.MissingResourceException

javax.ejb.NoSuchEJBException

javax.faces.application.ViewExpiredException
javax.faces.FacesException
0 Karma

mirkoneverstops
Path Finder

This works:

|rex field=_raw "\s(?<a_exceptiontype>(java|javax)\.\w+\.\w+Exception)"

Tested.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one regex string. There may be others.

javax?\.[\.\w]+Exception
---
If this reply helps you, Karma would be appreciated.
0 Karma

jw44250
New Member

Not working @richgalloway.. im new to splunk

index=index* | rex field="javax?.[.\w]+Exception" |stats count
Result
Error in 'SearchOperator:rex': Usage: regex [field=]

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The syntax is incorrect and you need a capturing group. Try index=index* | rex "(?<Exception>javax?.[.\w]+Exception)" |stats count.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jw44250
New Member

something like i think

rex field=_raw "port (?

0 Karma

mpreddy
Communicator

try like this:

|stats c | eval _raw ="javax.ejb.NoSuchEJBException"|append[|stats c | eval _raw ="java.lang.Exception"] |append[|stats c | eval _raw ="javax.faces.application.ViewExpiredException"]| rex "(?^(java)x?.[.\w]+)"|stats c by exp

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...