Splunk Search

Why am I unable to REX out a subset of a field?

arist0telis
Explorer

I've got an alert I put together and am trying to REX multiple pieces of it out to their own columns. This is against the Splunk internal logging. I had no problem pulling errorCode since it has a clearly defined field-within-a-field, but I'm not able to pull a subset string of another part of the message

Query
index=_internal sourcetype=sfdc:object:log log_level=ERROR OR log_level=WARNING
| rex "\"errorCode\":\"(?<errorCode>[^\s]+)\""
| stats count(stanza_name) by stanza_name, log_level, errorCode, message

I've got the message at the end just to give me the query error, but what I'd like to do is REX that also like I did to get the errorCode as its own column. Below is a sample message, with the part in bold what I'd like to rex out to its own column. I can't find an example of doing that where there isn't a clear delineation within the message like "errorCode":"<error>"

[{"message":"\nFoo,Bar,FooBar,FooBar2\n ^\nERROR at Row:1:Column:232\nNo such column 'FooBar2' on entity 'MyAwesomeObject'. If you are attempting to use a custom field, be sure to append the '__c' after the custom field name. Please reference your WSDL or the describe call for the appropriate names.","errorCode":"INVALID_FIELD"}]

Labels (2)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Assuming the desired text always follows "ERROR at Row:*:Column:*" and that "\n" are literal characters then this should do it.  If these are not valid assumptions then please clarify the requirements.

index=_internal sourcetype=sfdc:object:log log_level=ERROR OR log_level=WARNING
| rex "ERROR at Row:\d+:Column:\d+\\n(?<message>[^\.]+)"
| rex "\"errorCode\":\"(?<errorCode>[^\s]+)\""
| stats count(stanza_name) by stanza_name, log_level, errorCode, message
---
If this reply helps you, Karma would be appreciated.
0 Karma

arist0telis
Explorer

Doesn't look like that did it. part of the problem is the added REX is using the protected name message, which is also the name of the entire field. When you add message to the stats at the end it does the same thing I had above, it just outputs the entire message without REXing out the part I care about.

And yes, those \n are literals. I did a copy and paste of the exact flat text.

I changed the query to remove the protected names of the fields, "No results found" when I include that new REX trying to pull out the error message.

index=_internal sourcetype=sfdc:object:log log_level=ERROR OR log_level=WARNING
| rex "ERROR at Row:\d+:Column:\d+\\n(?<msg>[^\.]+)"
| rex "\"errorCode\":\"(?<err>[^\s]+)\""
| stats count(stanza_name) by stanza_name, log_level, err, msg

If you cut off the msg at the end, I at least get my errorCode column err back clean so that part works, it's just the new REX still isn't finding and capturing the message.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Missing a couple of backslashes

| rex "ERROR at Row:\d+:Column:\d+\\\\n(?<msg>[^\.]+)"
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...