Splunk Search
Highlighted

mulitple regex extraction

Motivator

Hi,

I'm trying to extract two fields from the below data

02-08 07:33:41.211 E/Rules_LightBaseAction( 2660): com.icontrol.device.DeviceException: Failed to turn light off.


02-08 07:30:19.611 E/Rules_LightBaseAction( 2660): Caused by: com.icontrol.zigbee.service.ZigbeeServiceException: executeCommand returned failure.

rulename=LightBaseAction and result=Failed to turn light off OR executeCommand returned failure

my attempt at the regex works for the rulename but not so much for the result.... What am I missing on the below regex?

E\/Rules_(?<rulename>\w+)(DeviceException|ZigbeeServiceException):\s+(?<result>$)
Tags (2)
0 Karma
Highlighted

Re: mulitple regex extraction

Motivator

try something like this,

base search | rex "E/Rules_(?<rulename>\w+).*(DeviceException|ZigbeeServiceException):\s+(?<result>.*)$"

Hope this will helps you.

View solution in original post

Highlighted

Re: mulitple regex extraction

Motivator

Hi Vasanthmss!

Thank you! that helped! The final regex looks like this . E\/Rules_(?<rulename>\w+).*Exception:\s(?<result>.+[^.])

0 Karma
Highlighted

Re: mulitple regex extraction

Motivator

glad that helped.. accept the answer.

0 Karma
Highlighted

Re: mulitple regex extraction

Motivator

attempt #2 at regex but still no joy . E\/Rules_(?<rulename>\w+)Exception:\s(?<result>.+[^.])

0 Karma