How to show all message from certain log via rex?

[ivana27]

Hi dear Splunkers,

i have log like this :

2021-02-11 14:47:51.167 [Error] ** Dummy User with dummyNumb:1111 Plate:AAAAA Country:Dummy paid dummy on DunnoOrder:2222222, but Dum sz: erere:45454545 not dispensed for Carouserl_Error !!!

And i would like to display everything after [Error] **.

I tried like this but i got error:

| rex "\[Error\]\s**\s(?<message>)"

Please help

Thank you

[kamlesh_vaghela]

@ivana27 

Can you please try this?

| rex "\[Error\]\s\*\*\s(?<message>.*)"

 Sample Search:

| makeresults 
| eval _raw="2021-02-11 14:47:51.167 [Error] ** Dummy User with dummyNumb:1111 Plate:AAAAA Country:Dummy paid dummy on DunnoOrder:2222222, but Dum sz: erere:45454545 not dispensed for Carouserl_Error !!!" 
| rex "\[Error\]\s\*\*\s(?<message>.*)"

[kamlesh_vaghela]

oops.. late reply 🙂 

[ivana27]

Thank you in any case 🙂

Do you know how to put messages from Error one after another and not in horizontal view?

@kamlesh_vaghela 

[ITWhisperer]

What delimits the parts of the message you want to separate?

[ivana27]

Should be split by _time of log, should look like this

2021-02-12 00:35:20.820  [Error] ## sample1 bla bla bla
2021-02-12 00:35:20.836  [Information] sample2 bla bla bla
2021-02-12 00:35:30.731 [Information] sample3 bla bla bla
2021-02-12 00:35:31.429 [Information] sample4 bla bla bla
2021-02-12 00:35:31.506 [Error] ## sample5 bla bla bla
2021-02-12 00:35:31.519 [Error] ** sample6 bla bla bla

And now i have search like this which displays in same row:

index=pkg_prespvm host IN (*)
| dedup _raw
| transaction host startswith="[Information] STEP = Dummy" endswith="[Information] -- START TRANSACTION --"
| rex field=_raw "plate:(?<info>[^,]+)"
| rex "\[Error\]\s\*\*\s(?<message>.*)"
| rex "\[Error\]\s\##\sGet\sDuuno\sTransaction\s(?<tranok>.*)"
| rex "\[Error\]\s\CustNum:\s(?<customer>.*)"
| search "Get Transaction NOK --> Payment:OK"
| stats count by host _time tranok message customer info
| table _time host customer tranok message info

[kamlesh_vaghela]

Can you please share your expected sample output. So I can help you..

[ITWhisperer · Accepted solution]

| rex "\[Error\]\s\*\*\s(?<message>.*)"