How to extract a filed which is in 4th line in log | Field Extraction

[ksidkumar]

I a trying to Extract the exception Name which is at the 4th line in log generated as below -

<CS-1>2022-02-03T14:58:21.128+0100 ERROR org.flowable.job.service.impl.asyncexecutor.DefaultAsyncRunnableExecutionExceptionHandler 77037 DefaultAsyncRunnableExecutionExceptionHandler.java:44 -
[{user=system}]
- Job JOB-2d21fa4f-84f8-11ec-9094-02425ecfb8fb failed
org.flowable.common.engine.api.FlowableOptimisticLockingException: JobEntity [id=JOB-2d21fa4f-84f8-11ec-9094-02425ecfb8fb] was updated by another transaction concurrently
at org.flowable.common.engine.impl.db.DbSqlSession.flushDeleteEntities(DbSqlSession.java:643) ~[flowable-engine-common-6.6.0.17.jar!/:6.6.0.17]

I want to have the filed extraction of the Exception Name which is highlighted above in blue. - its position is 4th line and till the colon(:)

I am trying to use this which does not work in splunk field extraction regex- 
^(.*\n){3}(?P<test_work_error>.+Exception:) 

Please advise. Thanks in advance

[johnhuang]

failed\s+(?<test_work_error>[\w\.]*Exception)\:

[PickleRick]

Are you sure it's on the fourth line? Pasting here seems to have massacred your event. Anyway, in such case it's usually easier to anchor to some known "static" part of message.

Like

Job\s(?<JobID>\S+)\sfailed\s(?<exception>\S+):

[ksidkumar]

Hi @PickleRick 

Yes its on the 4th line.. 

Main issue is that we really don't have any static filed to track like u used JobId.
only i know is the 4th line till the word Exception: is encountered.

what i was trying is - ^(.*\n){3}(?P<test_work_error>.+Exception:)
It works fine in any regex environment but not in Splunk filed extraction

[PickleRick]

If your events really get split properly and you indeed have multiline events. And you want the particular line, you should fiddle with the multiline regex modifiers (m and s) and line ends matching modifiers (*LF *CR *ANY and so on). I'm not sure which are on or off by default.