How to extract more number of strings under the same field name?

[Madhan45]

my event is - "common.exceptions.CommandFailedAtServerException:
concurrent.ExecutionException:
common.SocketPoolException: Unable to connect socket ... 3 lines omitted: java.net.ConnectException: Connection refused ... 8 lines omitted ... common.exceptions.CommandFailedException: "

i want to extract strings "CommandFailedAtServerException, ExecutionException, SocketPoolException java.net.ConnectException CommandFailedException" from the above event under the single filed?

How can i do that?

[woodcock · Accepted solution]

Like this:

| rex max_match=0 "(?im).*?(?<Exceptions>[\S]*Exception[\S]*)"

[Madhan45]

And one more question. I have two source files and they are containing following fields
1.source=Order, fields= Key,Name,Product,Price
2.source=Delivery, fields=Key,Shipdat,delivery location,price,

The data which comes under "Delivery" should fall under "delivered" category for that i have used this join query ""source="Delivery.csv"| eval status="Delivered"|join Key [source=order.csv|]"" and i got the result.

So how to use the join query for the category "Not delivered"

[woodcock]

Try this:

source="Delivery.csv" OR source="order.csv" | stats values(*) AS * BY Key | where isnull(delivery)

If that doesn't do it, ask a new question in the forum.

[Madhan45]

Hi woodcock.. thats really great... could u explain me the logic?

[Madhan45]

great.. thanks a ton

[woodcock]

The rex command takes the _raw field and applies the RegEx to it as many times as possible (max_match=0). The i is for ignore case and the m is for multiline. we skip as few characters as possible to get to non-whitespace characters that end with "Exception" followed by as many non-whitespace characters as possible (this creates the whitespace boundaries) and we call that captured string Exceptions.