Splunk Search

Regex works inline search but not as field extraction...

Builder

I have a regex I am using to extract exception from a java stacktrace to get for error analysis. It would be much better to do this as a configured field extract so I can use it in lookups instead of instead of embedding it in my growing base macro. Any help would be appreciated, thanks in advance.

PS... I am a support power user not an admin so what I do is through splunk web, though I can get changes made if I know what to ask for.

In splunk web for field extractions I have this set up... it does NOT work here.

Build id: .*\n(?P<EXCEPTION5>[^\n\t,^\r,^0-9,^=]+)

However, in an inline search of the same events it works... to pull

"com.X.service.concurrent.exception.ServiceCallException"

using

| rex "Build id: .*\n(?P<EXCEPTION5>[^\n\t,^\r,^0-9,^=]+)"

FROM this event...

ERROR 2014-07-08 17:39:53,484 buildId:X uid:X uiTimingId:InitialStartup-X cid:X clientId:X clientCAID:00JD49W7HBZSZ8S9DYLI {[ACTIVE] ExecuteThread: '223' for queue: 'weblogic.kernel.Default (self-tuning)'} [uiError.critical] clientId:weberr:framework.Err100.message weberrmsg:Uncaught exception during remote object call: X.Y()
Correlation id: 0000000000000000000000000bd910ac-5ab9-53bc6526-836b3940-5513668b5113
Build id: NR_PNG_BUILD_201406271012_RC_RTC-png2014-jun_42
com.X.service.concurrent.exception.ServiceCallException
    at com.X.xml.X.X.locking.v1.ws.concurrent.LockClientResponseCall.getResponseObjLockClientResponse(LockClientResponseCall.java:64)
1 Solution

SplunkTrust
SplunkTrust

Make sure you've added the field extraction to the correct sourcetype and app. The regex in and of itself seems okay, albeit very messy - you may want to simplify to this: Build id:[^\r\n]+[\r\n]+(?<EXCEPTION5>\S+)

View solution in original post

SplunkTrust
SplunkTrust

Make sure you've added the field extraction to the correct sourcetype and app. The regex in and of itself seems okay, albeit very messy - you may want to simplify to this: Build id:[^\r\n]+[\r\n]+(?<EXCEPTION5>\S+)

View solution in original post

SplunkTrust
SplunkTrust

You can click the check mark to the left of the answer to do that.

Builder

Not sure how to mark this answered, but thank you martin! This helped me embed a complex autolookup that will be very useful across my organization.

0 Karma

Builder

Simplifying the regex worked. Thanks!

I was on correct sourcetype and app.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!