RegEx to Find First Match of OR

[chrisboy68]

Hi, banging my head...

04/22/2016 09:23:50,865 - ERROR - exception occurred --- FOO BAR
Severity:        Error
Message:         Timeout expired. 
MachineName:     MY MACHINE


04/22/2016 09:23:56,318 - ERROR - exception occurred --- System.Data.SqlClient.SqlException: Timeout expired.  The timeout period elapsed prior to completion of the operation or the server is not responding.
   at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)

I have a single log file that contains the two formats. What I want to do is if the entry has "Message:", then make this the extracted field ErrorMessage, Else If the entry have "ERROR" then, make this the extracted field ErrorMessage.

(?:Message:)|(?:ERROR -)|\s+(?P(?:[^\n]*)) this is the regex I started with and modified with few things and I still can't get it right.

Help appreciated.

Thank you,

Chris

[ktugwell_splunk · Accepted solution]

You could do 2 field extractions both producing the same field name ErrorMessage

props.conf

[yoursourcetype]
EXTRACT-1 = Message:\s+(?<ErrorMessage>[A-Za-z0-9 ]+)
EXTRACT-2 = \d{2}\/\d{2}\/\d{4}\s\d{2}:\d{2}:\d{2},\d{3}\s-\sERROR\s-\s(?<ErrorMessage>.+)

That regex isn't the best in the world but you can keep tweaking it to suit your needs

Be sure to add all the possible characters you may see after "Message:" in this part of the regex [A-Za-z0-9 ]

[chrisboy68]

Thanks, but wouldn't that still execute both EXTRACTs? I just want One or the Other.

Chris

[ktugwell_splunk]

Give it a try, I may be wrong, but I think you'll only only see EXTRACT-2 as ErrorMessage if EXTRACT-1 doesn't exist. Either that or it'll create a multi value field.

[chrisboy68]

Thanks. You look to be correct! Its working.

Chris

[ktugwell_splunk]

Good stuff!