Splunk Search

How to edit the regular expression in my search to extract a field?

KrutikaDe
New Member

Hi,

I am trying to extract error message and error code from logs in Splunk.

I can see 2 patterns of these-
pattern 1 --> error code ASDAGWS_SEARCH_EMPTY_RESULTS error message Sorry, we can't find anything that matches your search for crumbly lancashire

the regex for ths is--> error\scode\s(?.*)\serror\smessage\s(?.*)

pattern 2 --> errorcode=ASDAGWS_InvalidPageNumberOrSize&errormsg=Incorrect page number or size&RO=null
the regex for ths is-->errorcode\=(?.*)_Error\&errormsg=(?.*)

I want to extract pattern 1 first if the first pattern does not exist in the event, 2nd pattern will exist for sure, and I want to extract that.

The regex I have written is as follow--but this is not working

| rex field=_raw "(error\scode\s(?.*)\serror\smessage\s(?.*) OR errorcode\=(?.*)_Error\&errormsg=(?.*)

can someone let me know how can I proceed with that.

0 Karma

woodcock
Esteemed Legend

Try these:

| rex max_match=0 "error\scode\s(?<capture1a>.*)\serror\smessage\s(?<capture1b>.*)(?:$|[\r\n]+)"
| rex max_match=0 "errorcode=(?<capture2a>.*)&errormsg=(?<capture2b>.*)(?:$|[\r\n]+)"
| rex max_match=0 "error\s*code(?:\s|=)(?<capture1>.*)(?:\serror\smessage\s|&errormsg=)(?<capture2>.*)(?:$|[\r\n]+)"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

In my experience, Splunk regex generator doesn't handle complex patterns well. This worked with your sample data and should be a good starting point.

... | rex "error\s?code(?:\s|=)(?.)(?:\serror\smessage\s|_Error\&errormsg=)(?.)" | ...

---
If this reply helps you, Karma would be appreciated.
0 Karma

niketn
Legend

@KrutikaDe, I would suggest to let Splunk generate Regular Expression through Interactive Field Extraction. Following step by Step process from the the documentation (this would be better than rex command since Fields will persist as Knowledge Objects which can be easily maintained and reused. http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX

Start off with the following search query (add index, sourcetype and other metadata fields to your base search)

<Your Base Search > "error code" OR "errorcode="

Then, you can choose Extract new fields option from Search Sidebar and follow remaining steps.
Alternatively you can create Two Separate Fields for Error Code based on their respective pattern and then coalesce the fields using eval to get error code which is available.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...