How to write a Rex query that will ignore some characters and then extract the message?

[Splunk235]

I have error logs like the below. How can I write a Rex query to match both the logs and only extract the message after the first colon (:)? Thanks.

Sample Log lines:

Script exception for job id 'ABc12345' : Too many rows: 500.

Script exception for job id 'XyZ78943' : Too many DMLs: 20.

Results should be:

Too many rows: 500.

Too many DMLs: 20.

[Thulasinathan_M]

Hi,
Here is the try anywhere query for your requirement.

| makeresults 
| eval _raw="Script exception for job id 'ABc12345' : Too many rows: 500."
| rex field=_raw ": (?<Extracted>.*)"

[gcusello · Accepted solution]

Hi @Splunk235,

please try this regex:

| rex "Script exception for job id \'\w*\d*\' : (?<message>[^\.]*)"

that you can test at https://regex101.com/r/tJwzeA/1

Ciao.

Giuseppe

[Splunk235]

Is there a way to embed the same into this query?

rex field=logLine "(Error Occurred During Script|UnhandledException ->)(\s|\S)(?<errorMessage>.*)"

This didn't work, but something like this?

rex field=logLine "(Error Occurred During Script|for job id \'\w*\d*\' :|UnhandledException ->)(\s|\S)(?<errorMessage>.*)"

[gcusello]

Hi @Splunk235 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[gcusello]

Hi @Splunk235 ,

yes, you can test your regex and it runs.

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉