I am trying to extract the type and message field for the exception information in the application logs. I have abstracted the logs because they are quite long. The logs can have between 1 to 3 Exception Information groups, and I need the type and message field from each one. I have tried the following regex in my props file without success. These have been tested and worked on https://regex101.com/#pcre. The first one works, but the second and third are not working.
EXTRACT-exception_message1 = \bType: \b.*?\n\bMessage: \b(?P<exception_message>.*?)\n
EXTRACT-exception_message2 = 2\)(?:.*\n){3}\bMessage: \b(?P<exception_message>.*?)\n
EXTRACT-exception_message3 = 3\)(?:.*\n){3}\bMessage: \b(?P<exception_message>.*?)\n
I have also tried extracting to separate fields by naming the fields.
<exception_message1>
<exception_message2>
<exception_message3>
While the type field will be useful, my priority is to get the message field extracting properly.
Here is an example of a log.
somefields=value
General Information
*********************************************
morefields=morevalues
1) Exception Information
*********************************************
Type=value
Message=value
otherfields=values
Stack Trace Information
*********************************************
stacktraceinfo
2) Exception Information
*********************************************
Type=value
Message=value
otherfields=values
Stack Trace Information
*********************************************
stacktraceinfo
I believe you're looking to extract Type and message as multivalued field extraction, so you would use a props-transform for that.
See this
https://answers.splunk.com/answers/112311/multi-value-field-extraction.html
http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Createandmaintainsearch-timefieldextract...
Another method will be use fields.conf
http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureSplunktoparsemulti-valuefields
I believe you're looking to extract Type and message as multivalued field extraction, so you would use a props-transform for that.
See this
https://answers.splunk.com/answers/112311/multi-value-field-extraction.html
http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Createandmaintainsearch-timefieldextract...
Another method will be use fields.conf
http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureSplunktoparsemulti-valuefields
This pointed me in the right direction, thanks.