Splunk Search

How to edit the regular expression in my search to extract a field?

New Member


I am trying to extract error message and error code from logs in Splunk.

I can see 2 patterns of these-
pattern 1 --> error code ASDAGWS_SEARCH_EMPTY_RESULTS error message Sorry, we can't find anything that matches your search for crumbly lancashire

the regex for ths is--> error\scode\s(?.*)\serror\smessage\s(?.*)

pattern 2 --> errorcode=ASDAGWS_InvalidPageNumberOrSize&errormsg=Incorrect page number or size&RO=null
the regex for ths is-->errorcode\=(?.*)_Error\&errormsg=(?.*)

I want to extract pattern 1 first if the first pattern does not exist in the event, 2nd pattern will exist for sure, and I want to extract that.

The regex I have written is as follow--but this is not working

| rex field=_raw "(error\scode\s(?.*)\serror\smessage\s(?.*) OR errorcode\=(?.*)_Error\&errormsg=(?.*)

can someone let me know how can I proceed with that.

0 Karma

Esteemed Legend

Try these:

| rex max_match=0 "error\scode\s(?<capture1a>.*)\serror\smessage\s(?<capture1b>.*)(?:$|[\r\n]+)"
| rex max_match=0 "errorcode=(?<capture2a>.*)&errormsg=(?<capture2b>.*)(?:$|[\r\n]+)"
| rex max_match=0 "error\s*code(?:\s|=)(?<capture1>.*)(?:\serror\smessage\s|&errormsg=)(?<capture2>.*)(?:$|[\r\n]+)"
0 Karma


In my experience, Splunk regex generator doesn't handle complex patterns well. This worked with your sample data and should be a good starting point.

... | rex "error\s?code(?:\s|=)(?.)(?:\serror\smessage\s|_Error\&errormsg=)(?.)" | ...

If this reply helps you, Karma would be appreciated.
0 Karma


@KrutikaDe, I would suggest to let Splunk generate Regular Expression through Interactive Field Extraction. Following step by Step process from the the documentation (this would be better than rex command since Fields will persist as Knowledge Objects which can be easily maintained and reused. http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX

Start off with the following search query (add index, sourcetype and other metadata fields to your base search)

<Your Base Search > "error code" OR "errorcode="

Then, you can choose Extract new fields option from Search Sidebar and follow remaining steps.
Alternatively you can create Two Separate Fields for Error Code based on their respective pattern and then coalesce the fields using eval to get error code which is available.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...