Splunk Search

Splunk Regex help

viksvig
Loves-to-Learn Lots

Hi, I have the search returning the event

 Nov 10 23:45:3 8888888 Tra[9100]: { EventName: "Error Occurred", BatchId: 095cehcx-87ee-43f6-9663-c2fb833677a978, CorrelationId: 5fghja26b9-fe73-78cb-342b-5123f2ec167896, Payload: BusinessLogicException { Message: "Lead 0000000001VII6N00AX has an agency code that is not 7 digits.", Data: [], InnerException: null, TargetSite: Void Validate(uya.QueryModels.Lead), StackTrace: " at uyu.Models.Lead.Validate(Lead queriedLead)

 

How do i extract only the content on the Message

Message: "Lead 0000000001VII6N00AX has an agency code that is not 7 digits.:"

Labels (1)
Tags (1)
0 Karma

bhargavi
Path Finder

Hello,

Please try the below regex.

|rex field=_raw "\sMessage\:(?P<Message>.*)\,\s\Data"

0 Karma

manishchoudhary
Loves-to-Learn

Hello @viksvig ,

 

Please use the below regex value in order to extract the message field at search time. Also, in order to extract the message field for all the logs put this regex value in Setting --> Field extraction 
.*?Message:\s+"(?P<message>.*?)" 

Kindly let me know if it works fine in your environment

Tags (1)
0 Karma

viksvig
Loves-to-Learn Lots

It works in the search , but when it sends it as email alert, it only has the dates and the message field is empty

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far.

See if this regex helps

 

| rex "(?<Message>Message: \\\"[^\\\"]+\\\")"

 

If you only need the message itself, then try this

 

| rex "Message: \\\"(?<Message>\\\"[^\\\"]+)"

 

---
If this reply helps you, an upvote would be appreciated.
0 Karma

viksvig
Loves-to-Learn Lots

@richgalloway 

Getting an error for the 1st search

| rex "(?<Message>Message: \\\"[^\\\\"]+\\\")"

Error in 'SearchParser': Missing a search command before '^'. Error at position '81' of search query 'search index=cloud EventName: "Error Occurred" | ...{snipped} {errorcontext = Message>"[^\\\\"]+)"}'.

Getting error for 

| rex "Message: \\\"(?<Message>"[^\\\\"]+)"

Mismatched ']'.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sorry about that.  I had the wrong number of escape characters.  Please try my revised answer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

viksvig
Loves-to-Learn Lots

It works in the search , but when it sends it as email alert, it only has the dates and the messagews are empty

0 Karma

viksvig
Loves-to-Learn Lots

@richgalloway @manishchoudhary @bhargavi  any idea why 

I have splunk search - index=cloud EventName: "Error Occurred" XChangeToSalesForce | rename message as "Message" _time as Time | table Time,Message

When i search on splunk search, i get the below response

1637759064  Multiple Terms found for the same agency. Agency code: 

But when the email is sent, i get nothing on the message field . It is set as inline

Time

Message

1637759064 
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>