whats the rex command to filter the special characters and extract only required fields?

[guru89044]

Hello experts,

logs looks something like this..

(java.lang.RuntimeException: java.util.concurrent.ExecutionException: java.lang.RuntimeException:...

null\n\njava.lang.IllegalArgumentException
: java.util.concurrent.ExecutionException..
( java.util.concurrent.ExecutionException)
" java.util.concurrent.ExecutionException"

query should ignore the special characters before java and take only exception.

example: query should find "java.lang.IllegalArgumentException" from this log line "null\n\njava.lang.IllegalArgumentException".

I am able to pull exceptions which are not associated with special characters using rex "(?java?.[.\w]+Exception)" but

thanks

[mayurr98]

can you please provide full sample events and output you want?

[bangalorep]

Hello!
Try this run anywhere search

| makeresults 
| eval _raw="null\n\njava.lang.IllegalArgumentException
: java.util.concurrent.ExecutionException..
( java.util.concurrent.ExecutionException)
\" java.util.concurrent.ExecutionException\"" 
| rex field=_raw max_match=0 "(?<javaexception>java?.[.\w]+Exception)"

You can try something like this

| rex field=_raw (?<javaexception>java?.[.\w]+Exception)

OR

| rex field=_raw (?<javaexception>java.*Exception)

[guru89044]

ddint work. its not correct.

[bangalorep]

I edited my answer. did you check?
Also, if its not correct can you elaborate by giving sample inputs and what output you want

[bangalorep]

Try this run anywhere search

| makeresults 
| eval _raw="null\n\njava.lang.IllegalArgumentException
: java.util.concurrent.ExecutionException..
( java.util.concurrent.ExecutionException)
\" java.util.concurrent.ExecutionException\"" 
| rex field=_raw max_match=0 "(?<java>(\S+|)java.\w+.*Exception)"

[guru89044]

no rex command is still not working.

[bangalorep]

Can you please send me one full event? Also, please send the search query you're using.

[guru89044]

my end goal is

https://answers.splunk.com/answers/620096/how-to-get-the-list-of-unique-exceptions-which-are.html

[bangalorep]

For this, you need to use max_match=0 in the rex expression.

Use this query

rex field=_raw max_match=0 "(?<java>(\S+|)java.\w+.*Exception)"