Splunk Search

Newb trying to use regex to extract fields

johnmackey
Engager

I'm still trying to understand rex to extract data from my search results. Can someone help me build a regex command with these examples please?

I'm trying to pull out the exception type (i.e. BwbRequestExceptions) and message into 2 separate fields:

com.beeweeb.mobileservices.tapestry.exceptions.BwbRequestException: Error while parsing server request

org.jboss.resteasy.plugins.providers.jaxb.JAXBUnmarshalException: javax.xml.bind.UnmarshalException
- with linked exception:
[org.xml.sax.SAXParseException: Content is not allowed in prolog.]

Tags (1)
0 Karma

rgaleone1
Path Finder

johnmackey -

Have you tried looking in to using the built-in Splunk Interactive Field Extractor?

Documentation here: Knowledge Users Manual and here: Extract fields interactively with IFX

0 Karma

johnmackey
Engager

Thanks! i'll try IFX. i think this is what i need.

0 Karma

rgaleone1
Path Finder

Yes, the Splunk Interactive Field Extractor is available in Splunk 5

Update for Spunk 5.x
Documentation here: Knowledge Users Manual and here: Extract fields interactively with IFX

You can change the documentation version (from 6.x to 5.x or w/e) in the upper right of the web page.

johnmackey
Engager

i'm in splunk 5. is that only in 6?

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...