Splunk Search

How do I extract these two fields from my sample data with regex?

rafasalo
Engager

Hello,

I have this log below and I would like to extract the field Message and Trace. When I use the regex created by Splunk, I don't get the right result. Could you help me with that?

"2015-12-10 13:28:35" id="2845413", InstanceName="Cappta.Gp.Services.Wcf", ProviderId="1BF07132-4A08-56AD-82DB-5B9FED4B5E86", ProviderName="PaymentApp EventSource", EventId="103", EventKeywords="0", Level="2", Opcode="0", Task="65431", Timestamp="2015-12-10 13:28:35.0978366 -02:00", Version="0", FormattedMessage="[12/10/2015 3:28:35 PM WIN-DP821V9ARS3] PaymentAppDateTime 12/10/2015 1:28:35 PM; MerchantCnpj: 07021091000190; CheckoutNumber: 1; PaymentApp: Cappta Gp PLUS 3.0.7.0; Message: [10/12/2015 13:13:03] - System.Net.Sockets.SocketException

Message: Uma tentativa de conexão falhou porque o componente conectado não respondeu
corretamente após um período de tempo ou a conexão estabelecida falhou
porque o host conectado não respondeu 201.20.40.181:443

Trace:    at System.Net.Sockets.Socket.EndConnect(IAsyncResult asyncResult)
   at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Int32 timeout, Exception& exception)
   at Cappta.Gp.Service.GpWebServices.WebServiceContext.SendRequest(HttpMethod httpMethod, String requestUri, Object content)
   at Cappta.Gp.Service.GpWebServices.PaymentTransactionSyncService.<>c__DisplayClass2.<ExecuteAsync>b__1()
   at System.Threading.Tasks.Task.InnerInvoke()
   at System.Threading.Tasks.Task.Execute()", Payload="{

  "message": "[12/10/2015 3:28:35 PM WIN-DP821V9ARS3] PaymentAppDateTime 12/10/2015 1:28:35 PM; MerchantCnpj: 07021091000190; CheckoutNumber: 1; PaymentApp: Cappta Gp PLUS 3.0.7.0; Message: [10/12/2015 13:13:03] - System.Net.Sockets.SocketException\r\nMessage: Uma tentativa de conexão falhou porque o componente conectado não respondeu\r\ncorretamente após um período de tempo ou a conexão estabelecida falhou\r\nporque o host conectado não respondeu 201.20.40.181:443\r\nTrace:    at System.Net.Sockets.Socket.EndConnect(IAsyncResult asyncResult)\r\n   at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Int32 timeout, Exception& exception)\r\n   at Cappta.Gp.Service.GpWebServices.WebServiceContext.SendRequest(HttpMethod httpMethod, String requestUri, Object content)\r\n   at Cappta.Gp.Service.GpWebServices.PaymentTransactionSyncService.<>c__DisplayClass2.<ExecuteAsync>b__1()\r\n   at System.Threading.Tasks.Task.InnerInvoke()\r\n   at System.Threading.Tasks.Task.Execute()\r\n"
}", ActivityId="00000000-0000-0000-0000-000000000000", RelatedActivityId="00000000-0000-0000-0000-000000000000", ProcessId="5140", ThreadId="3860", CreationDateTime="2015-12-10 13:28:35.097"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This regex string works on regex101.com with your sample data.

"Message: \[.*?(?P<Message>Message:.*?)(?P<Trace>Trace:[^\{]*)"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...