Splunk Search

Regex works inline search but not as field extraction...

snoobzilla
Builder

I have a regex I am using to extract exception from a java stacktrace to get for error analysis. It would be much better to do this as a configured field extract so I can use it in lookups instead of instead of embedding it in my growing base macro. Any help would be appreciated, thanks in advance.

PS... I am a support power user not an admin so what I do is through splunk web, though I can get changes made if I know what to ask for.

In splunk web for field extractions I have this set up... it does NOT work here.

Build id: .*\n(?P<EXCEPTION5>[^\n\t,^\r,^0-9,^=]+)

However, in an inline search of the same events it works... to pull

"com.X.service.concurrent.exception.ServiceCallException"

using

| rex "Build id: .*\n(?P<EXCEPTION5>[^\n\t,^\r,^0-9,^=]+)"

FROM this event...

ERROR 2014-07-08 17:39:53,484 buildId:X uid:X uiTimingId:InitialStartup-X cid:X clientId:X clientCAID:00JD49W7HBZSZ8S9DYLI {[ACTIVE] ExecuteThread: '223' for queue: 'weblogic.kernel.Default (self-tuning)'} [uiError.critical] clientId:weberr:framework.Err100.message weberrmsg:Uncaught exception during remote object call: X.Y()
Correlation id: 0000000000000000000000000bd910ac-5ab9-53bc6526-836b3940-5513668b5113
Build id: NR_PNG_BUILD_201406271012_RC_RTC-png2014-jun_42
com.X.service.concurrent.exception.ServiceCallException
    at com.X.xml.X.X.locking.v1.ws.concurrent.LockClientResponseCall.getResponseObjLockClientResponse(LockClientResponseCall.java:64)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Make sure you've added the field extraction to the correct sourcetype and app. The regex in and of itself seems okay, albeit very messy - you may want to simplify to this: Build id:[^\r\n]+[\r\n]+(?<EXCEPTION5>\S+)

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Make sure you've added the field extraction to the correct sourcetype and app. The regex in and of itself seems okay, albeit very messy - you may want to simplify to this: Build id:[^\r\n]+[\r\n]+(?<EXCEPTION5>\S+)

martin_mueller
SplunkTrust
SplunkTrust

You can click the check mark to the left of the answer to do that.

snoobzilla
Builder

Not sure how to mark this answered, but thank you martin! This helped me embed a complex autolookup that will be very useful across my organization.

0 Karma

snoobzilla
Builder

Simplifying the regex worked. Thanks!

I was on correct sourcetype and app.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...