Splunk Search

How to correct my regex to extract text from two or more lines?

Bhuavana
Explorer

Hi,

Please let me know the regex to extract text from 2 or 3 more lines.

For below log text :

ClientIp=065162175003 : - Exception while getting fileApolloWhitelistedCredentials.properties ResourceHandler:getConfirationProperties() 
java.io.FileNotFoundException: /apps/mobiliser5.1.0/02/money/conf/ApolloWhitelistedCredentials.properties (No such file or directory)
 at 

I have used the below regex but it extracts text [from-- Exception while getting] and [till-- getConfirationProperties()] but text at next line[java.io.FileNotFoundException --> is not appended] to the field exception_msg.

| rex field=_raw "ClientIp=d{12} :  -(?(.*)+[\n at]\n)"

Kindly let me know the correct regex to extract text starting from [Exception..... ]till [(No such file or directory)]

Tags (2)
0 Karma

Venkat_16
Contributor

hi Bhuavana,

   ClientIp=\d{12}\s\:\s\-\s(?P<msg>(.|\r)+?)\(No\ssuch\sfile\sor\sdirectory\)

       please try this...

Thanks,
Venkat

MuS
SplunkTrust
SplunkTrust

Hi Bhuavana,

try something like this:

your base search here | rex field=_raw "ClientIp=\d{12}\s\:\s\-\s(?<myMsg>(?s).*)\(No\ssuch\sfile\sor\sdirectory\)" | table myMsg

cheers, MuS

Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...