Splunk Search

Regex isnt working for my search string

navd
New Member

I want to extract a field from the log event using regex .following is the sample log event , can someone tell me how to write rex for it .My rex isn't working ,it says mismatched ']'

java.util.concurrent.Exception: Code: Internal Server Error; Exception: com.rate.ps.execute.exception.Exception: { "message": "not upto date" }
... 11 lines omitted ...

I want to write rex for "Code: Internal Server Error; Exception: com.rate.ps.execute.exception.Exception: { "message": "not upto date" }"

|rex (?([a-zA-Z]\w+.)+\w*Exception\W+[^"]+\W:\W+[^"]+\W*)

Tags (1)
0 Karma

jodyfsu
Path Finder

Not real sure which part you are trying to capture, but here is what I came up with:

| rex "java\.util\.concurrent\.Exception\:\s(?<CODE>.[^\;]+)\;\sException\:(?<EXCEPTION>.[^\:]+)\:\s\{\s(?<MSG>.[^\}]+)"

Let me know if you need more.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...