Splunk Search

Trying to extract field in log file, can you please help with regex and field extraction.

PavanSeerapu
Explorer

Caused by: java.sql.SQLException: Io exception: Socket closed

i want to extract "java.sql.SQLException"

 

Can you please do the needful.

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @PavanSeerapu,

You can use below rex command;

 

| rex "[^:]+:\s+(?<exception>[^:]+)"

 

If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @PavanSeerapu,

This regex does not work, because there is a problem with double-quotes and there is no numeric value. Please try below;

| rex "java.sql.SQLException:\s+(?<SQLexception>.*)"
If this reply helps you an upvote is appreciated.
0 Karma

PavanSeerapu
Explorer

| rex field=_raw "Caused by"\:\s+(?P<SQLexception>\d+)

 

I tried this but didn't work

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @PavanSeerapu,

You can use below rex command;

 

| rex "[^:]+:\s+(?<exception>[^:]+)"

 

If this reply helps you an upvote is appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>