Regex Expression to find errors not matching

[sphiwee]

Can someone show me what the regex expression for the below extract would be? & can you show me how you arrived to that conclusion, NB i have tried reg101 and Im still confused.

i have tried this expression

rex field=_raw "ERROR - (?<Error_Message>.+)"

2020-08-17 16:34:02,141 [68618-1397] ERROR NodePoolServlet - [urn:uuid:6144BCB27826B3BECC1597674752077153] Bot Manager can't find a free Bot to execute a robotic task. Please check that Bots with requested capabilties are alive using the Healtcheck API and the Bot Source size in Control Tower is equal to the number of available Bots.

[thambisetty]

The regex you posted extracted nothing from the event posted.

rex field=_raw "ERROR - (?<Error_Message>.+)" to explain your regex.

field=_raw - indicates Splunk to look  in _raw field for extraction ERROR - (?<Error_Message>.+)

The extraction "ERROR - (?<Error_Message>.+)" - first identify  ERROR - and value will be extracted after ERROR - till end of line  and the value will be kept in Error_Message field.

Find below video useful

Regular Expressions in Splunk 

[to4kawa]

rex field=_raw "ERROR - (?<Error_Message>.+)" is match

ERROR - <<SOMETHING>>

2020-08-17 16:34:02,141 [68618-1397] ERROR NodePoolServlet - [urn:uuid:6144BCB27826B3BECC1597674752077153] Bot Manager can't find a free Bot to execute a robotic task. Please check that Bots with requested capabilties are alive using the Healtcheck API and the Bot Source size in Control Tower is equal to the number of available Bots.

your log does not have -(hyphen) after ERROR. so this can't match.

"ERROR\s(?<Error_Message>\S+)"

[impurush]

@sphiwee 
If I understand correctly, you need the error details in a keyword after the ERROR message.

2020-08-17 16:34:02,141 [68618-1397] ERROR NodePoolServlet - [urn:uuid:6144BCB27826B3BECC1597674752077153] Bot Manager can't find a free Bot to execute a robotic task. Please check that Bots with requested capabilties are alive using the Healtcheck API and the Bot Source size in Control Tower is equal to the number of available Bots.

You can use the below regex format to achieve that.

<your query>|rex field=_raw "ERROR\s(?<Error_Message>.+)"

[sphiwee]

no only need this part "ERROR NodePoolServlet -"

[impurush]

Hi @sphiwee 

Use the below one

<your query>|rex field=_raw "ERROR\s(?<Error_Message>.+)\-"