Why am I unable to REX out a subset of a field?

[arist0telis]

I've got an alert I put together and am trying to REX multiple pieces of it out to their own columns. This is against the Splunk internal logging. I had no problem pulling errorCode since it has a clearly defined field-within-a-field, but I'm not able to pull a subset string of another part of the message

Query
index=_internal sourcetype=sfdc:object:log log_level=ERROR OR log_level=WARNING
| rex "\"errorCode\":\"(?<errorCode>[^\s]+)\""
| stats count(stanza_name) by stanza_name, log_level, errorCode, message

I've got the message at the end just to give me the query error, but what I'd like to do is REX that also like I did to get the errorCode as its own column. Below is a sample message, with the part in bold what I'd like to rex out to its own column. I can't find an example of doing that where there isn't a clear delineation within the message like "errorCode":"<error>"

[{"message":"\nFoo,Bar,FooBar,FooBar2\n ^\nERROR at Row:1:Column:232\nNo such column 'FooBar2' on entity 'MyAwesomeObject'. If you are attempting to use a custom field, be sure to append the '__c' after the custom field name. Please reference your WSDL or the describe call for the appropriate names.","errorCode":"INVALID_FIELD"}]

[richgalloway]

Assuming the desired text always follows "ERROR at Row:*:Column:*" and that "\n" are literal characters then this should do it.  If these are not valid assumptions then please clarify the requirements.

index=_internal sourcetype=sfdc:object:log log_level=ERROR OR log_level=WARNING
| rex "ERROR at Row:\d+:Column:\d+\\n(?<message>[^\.]+)"
| rex "\"errorCode\":\"(?<errorCode>[^\s]+)\""
| stats count(stanza_name) by stanza_name, log_level, errorCode, message

[arist0telis]

Doesn't look like that did it. part of the problem is the added REX is using the protected name message, which is also the name of the entire field. When you add message to the stats at the end it does the same thing I had above, it just outputs the entire message without REXing out the part I care about.

And yes, those \n are literals. I did a copy and paste of the exact flat text.

I changed the query to remove the protected names of the fields, "No results found" when I include that new REX trying to pull out the error message.

index=_internal sourcetype=sfdc:object:log log_level=ERROR OR log_level=WARNING
| rex "ERROR at Row:\d+:Column:\d+\\n(?<msg>[^\.]+)"
| rex "\"errorCode\":\"(?<err>[^\s]+)\""
| stats count(stanza_name) by stanza_name, log_level, err, msg

If you cut off the msg at the end, I at least get my errorCode column err back clean so that part works, it's just the new REX still isn't finding and capturing the message.

[ITWhisperer]

Missing a couple of backslashes

| rex "ERROR at Row:\d+:Column:\d+\\\\n(?<msg>[^\.]+)"