Tabulate list of exception in logs

[thaara]

Hi Splunkers,

My logs are like below with same set of logs for different WAS ear's..

earFile=abc.ear
...................................
Error1: Exception with DMGR.....
Dbjbafjbjasbfbuasbhcbjsa

earFile=qrs.ear
...................................
Error2: SOAP exception..
skbdjasbjdgajsgdgush

My query should seach 'Error1' and 'Error2' keyword. In result, it should shows whole error message..

For eg,

If i search 'Error1' & 'Error2' in my query, output should be like below in table format...

Host EAR_Name Error
xyz abc.ear Error1: Exception with DMGR.....
Dbjbafjbjasbfbuasbhcbjsa

xyz qrs.ear Error2: SOAP exception..
skbdjasbjdgajsgdgush

[dindu]

Could you please try the below.

   |index="your_index" sourcetype="" Error1 Error2
   |rex field=_raw "(?P<err_message>Error.*)"
    |table host,earFile,err_message

[richgalloway]

What is your current query? What are your current results?

[thaara]

Current query:
index= " " sorucetype= " " Error

Result:
we are getting all the error patterns, but not in tabular format.

Expected output:
Hostname ear.name type of exception
xyz xyz.ear DMGR exception
abc abc.ear SOAP exception

[richgalloway]

As @dindu's answer suggests, you can use the table command to put your results in tabular form.
See https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html.