Splunk Search

How to edit the regular expression in my search to extract a field?

New Member


I am trying to extract error message and error code from logs in Splunk.

I can see 2 patterns of these-
pattern 1 --> error code ASDAGWS_SEARCH_EMPTY_RESULTS error message Sorry, we can't find anything that matches your search for crumbly lancashire

the regex for ths is--> error\scode\s(?.*)\serror\smessage\s(?.*)

pattern 2 --> errorcode=ASDAGWS_InvalidPageNumberOrSize&errormsg=Incorrect page number or size&RO=null
the regex for ths is-->errorcode\=(?.*)_Error\&errormsg=(?.*)

I want to extract pattern 1 first if the first pattern does not exist in the event, 2nd pattern will exist for sure, and I want to extract that.

The regex I have written is as follow--but this is not working

| rex field=_raw "(error\scode\s(?.*)\serror\smessage\s(?.*) OR errorcode\=(?.*)_Error\&errormsg=(?.*)

can someone let me know how can I proceed with that.

0 Karma

Esteemed Legend

Try these:

| rex max_match=0 "error\scode\s(?<capture1a>.*)\serror\smessage\s(?<capture1b>.*)(?:$|[\r\n]+)"
| rex max_match=0 "errorcode=(?<capture2a>.*)&errormsg=(?<capture2b>.*)(?:$|[\r\n]+)"
| rex max_match=0 "error\s*code(?:\s|=)(?<capture1>.*)(?:\serror\smessage\s|&errormsg=)(?<capture2>.*)(?:$|[\r\n]+)"
0 Karma


In my experience, Splunk regex generator doesn't handle complex patterns well. This worked with your sample data and should be a good starting point.

... | rex "error\s?code(?:\s|=)(?.)(?:\serror\smessage\s|_Error\&errormsg=)(?.)" | ...

If this reply helps you, Karma would be appreciated.
0 Karma


@KrutikaDe, I would suggest to let Splunk generate Regular Expression through Interactive Field Extraction. Following step by Step process from the the documentation (this would be better than rex command since Fields will persist as Knowledge Objects which can be easily maintained and reused. http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX

Start off with the following search query (add index, sourcetype and other metadata fields to your base search)

<Your Base Search > "error code" OR "errorcode="

Then, you can choose Extract new fields option from Search Sidebar and follow remaining steps.
Alternatively you can create Two Separate Fields for Error Code based on their respective pattern and then coalesce the fields using eval to get error code which is available.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...