Splunk Search

How to correct my regex to extract text from two or more lines?

Bhuavana
Explorer

Hi,

Please let me know the regex to extract text from 2 or 3 more lines.

For below log text :

ClientIp=065162175003 : - Exception while getting fileApolloWhitelistedCredentials.properties ResourceHandler:getConfirationProperties() 
java.io.FileNotFoundException: /apps/mobiliser5.1.0/02/money/conf/ApolloWhitelistedCredentials.properties (No such file or directory)
 at 

I have used the below regex but it extracts text [from-- Exception while getting] and [till-- getConfirationProperties()] but text at next line[java.io.FileNotFoundException --> is not appended] to the field exception_msg.

| rex field=_raw "ClientIp=d{12} :  -(?(.*)+[\n at]\n)"

Kindly let me know the correct regex to extract text starting from [Exception..... ]till [(No such file or directory)]

Tags (2)
0 Karma

Venkat_16
Contributor

hi Bhuavana,

   ClientIp=\d{12}\s\:\s\-\s(?P<msg>(.|\r)+?)\(No\ssuch\sfile\sor\sdirectory\)

       please try this...

Thanks,
Venkat

MuS
Legend

Hi Bhuavana,

try something like this:

your base search here | rex field=_raw "ClientIp=\d{12}\s\:\s\-\s(?<myMsg>(?s).*)\(No\ssuch\sfile\sor\sdirectory\)" | table myMsg

cheers, MuS

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...