Splunk Search

Regular Expression to find the cases

akarivaratharaj
Communicator

I have to find a set of Exception names from my events. Below are the sample text and its corresponding Regular expression which I am trying

Sample Text:
1. Caused by: javax.transaction.TransactionRolledbackException:
2. Caused by: com.gtnexus.database.exception.NoEntryAffectedException:

Expression used:
rex field=_raw "Caused by: (?P^.(.+?)):"

Expect Result:
"TransactionRolledbackException"
"NoEntryAffectedException"

With my above regex I am getting "javax.transaction.TransactionRolledbackException" but I need only the exception name as "TransactionRolledbackException"

Could you please help me on this

0 Karma
1 Solution

andreacefali
Engager

Based on nittala answer:

rex field=_raw "Caused\sby\:\s.+\.(?<ExceptionName>[^:]+):"

This takes in consideration also an error that doesn't end with "Exception" word

View solution in original post

senthilgoa
Engager

(?[A-Z].*:)

(?
Assigned ==>
Starting Char ==> [A-Z]
Followed by any no char ==> .*
End with : ==> :
)

you get results like below

Match 1
Status= TransactionRolledbackException:
Match 2
Status= NoEntryAffectedException:

0 Karma

andreacefali
Engager

Based on nittala answer:

rex field=_raw "Caused\sby\:\s.+\.(?<ExceptionName>[^:]+):"

This takes in consideration also an error that doesn't end with "Exception" word

akarivaratharaj
Communicator

Wow! Thankyou!!

0 Karma

sudosplunk
Motivator

Hello, give this a try:

Note: I am assuming that exception name is always preceded by period .

rex field=_raw "Caused\sby\:\s.+\.(?<ExceptionName>\w+Exception):"

Tested here.

akarivaratharaj
Communicator

Thankyou for the response.

0 Karma

akarivaratharaj
Communicator

Both the answers by @nittala_surya and @andreacefali are useful. Thankyou for the quick help

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...