I have a script that outputs data in the following format. The problem is that the value of the Error field gets initialized to "No" and ignores the Error part. Also, the Error field could have have a completed stack trace and flow into multiple lines. How do I write the transforms stanza so that it assigns all the values to the "Error" field.
ElapsedTime=2.2812208, StatusCode=OK, ContentMatched=False, Error=No Error
Thank you
try the inline regex,
mysearch | rex field=hop "Error=(?<Error>([^=]*)$)" | table Error
then once confirmed working, you can define an automatic field extraction
see http://docs.splunk.com/Documentation/Splunk/4.2.5/Knowledge/Managesearch-timefieldextractions
Hi MuS, I need help with writing the complete regex. Could you please give me some pointers.
Thanks.
Hi danurag
you can use a regex like this ([^=]*)$
to match everything after the last = to be extracted
cheers