Splunk Search

I can't capture an unrecognized field with a space

dbaker42
Engager

I'm running the following command:
host=Computername AND EventCode=1309 | rename "Exception message" as Exception_message | dedup Application_Path | table Application_Path Exception_message

But it still won't recognize Exception message. If I expand the results, here is a snippet of the returned data:

Exception information: Exception type: HttpException Exception message: Server cannot set status after HTTP headers have been sent.

I'd like to create a table showing the Application Path and the Exception message, but I can't get it to recognize my field. Help! Thanks in advance.

Tags (1)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Looks like this is a windows log file. Try this:

host=Computername EventCode=1309 | rex field=_raw "Exception message:(?<exception_message>[^\r\n]*)"| dedup Application_Path| table Application_Path exception_message

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Looks like this is a windows log file. Try this:

host=Computername EventCode=1309 | rex field=_raw "Exception message:(?<exception_message>[^\r\n]*)"| dedup Application_Path| table Application_Path exception_message

alacercogitatus
SplunkTrust
SplunkTrust

Glad it worked for you, please accept the answer if it worked for you.

0 Karma

dbaker42
Engager

Brilliant! That worked perfectly. Thanks!

0 Karma

bmacias84
Champion

I am assuming you already have a field extraction or transform for this sourcetype and all the fields you are referencing?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...