Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Regex Expression to find errors not matching
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Regex Expression to find errors not matching
Can someone show me what the regex expression for the below extract would be? & can you show me how you arrived to that conclusion, NB i have tried reg101 and Im still confused.
i have tried this expression
rex field=_raw "ERROR - (?<Error_Message>.+)"
2020-08-17 16:34:02,141 [68618-1397] ERROR NodePoolServlet - [urn:uuid:6144BCB27826B3BECC1597674752077153] Bot Manager can't find a free Bot to execute a robotic task. Please check that Bots with requested capabilties are alive using the Healtcheck API and the Bot Source size in Control Tower is equal to the number of available Bots.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The regex you posted extracted nothing from the event posted.
rex field=_raw "ERROR - (?<Error_Message>.+)" to explain your regex.
field=_raw - indicates Splunk to look in _raw field for extraction ERROR - (?<Error_Message>.+)
The extraction "ERROR - (?<Error_Message>.+)" - first identify ERROR - and value will be extracted after ERROR - till end of line and the value will be kept in Error_Message field.
Find below video useful
If this helps, give a like below.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
rex field=_raw "ERROR - (?<Error_Message>.+)" is match
ERROR - <<SOMETHING>>
2020-08-17 16:34:02,141 [68618-1397] ERROR NodePoolServlet - [urn:uuid:6144BCB27826B3BECC1597674752077153] Bot Manager can't find a free Bot to execute a robotic task. Please check that Bots with requested capabilties are alive using the Healtcheck API and the Bot Source size in Control Tower is equal to the number of available Bots.
your log does not have -(hyphen) after ERROR. so this can't match.
"ERROR\s(?<Error_Message>\S+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@sphiwee
If I understand correctly, you need the error details in a keyword after the ERROR message.
2020-08-17 16:34:02,141 [68618-1397] ERROR NodePoolServlet - [urn:uuid:6144BCB27826B3BECC1597674752077153] Bot Manager can't find a free Bot to execute a robotic task. Please check that Bots with requested capabilties are alive using the Healtcheck API and the Bot Source size in Control Tower is equal to the number of available Bots.
You can use the below regex format to achieve that.
<your query>|rex field=_raw "ERROR\s(?<Error_Message>.+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
no only need this part "ERROR NodePoolServlet -"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @sphiwee
Use the below one
<your query>|rex field=_raw "ERROR\s(?<Error_Message>.+)\-"
Tech Talk Recap | Mastering Threat Hunting
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
Data Persistence in the OpenTelemetry Collector
