REX - Extracting multiple fields- What's the rex syntax to return microService AND warningMessage?

[Mick_OBrien]

I have raw message of the form...

2022-08-15T10:41:54.266337+00:00 microService 9bc7520a-4f8d-4edc-a4cd-b08c0fae8992[[APP/PROC/WEB/2]] APPENDER=APP, DATE=2022-08-15 10:41:54.266, LEVEL=WARN , USER=, THREAD=[pool-25-thread-1], LOGGER=Factory, CORR=, INT_CORR=, X-VCAP-REQUEST-ID=, MESSAGE=warningMessage

What's the rex syntax to return microService AND warningMessage?

[ITWhisperer]

| rex "^\S+\s(?<microservice>\S+).*MESSAGE=(?<message>.+)"

https://regex101.com/r/nE14zp/1

[Mick_OBrien]

Tried....

index=splunkIndex "*LEVEL=WARN*" | rex "^\S+\s(?<microservice>\S+).*MESSAGE=(?<message>.+)" | table _raw, microService, message

...and I see the message but NOT the microservice

FYI the returned _raw message starts...

2022-08-15T10:53:25.650962+00:00 microService

[ITWhisperer · Accepted solution]

Field names are case sensitive so microService is not the same as microservice (the name of the field in the rex extract)

[Mick_OBrien]

Thank  you - that worked!