I have a search that returns events from an error log. I would like to do a timechart sorted by error Message.
However I only want to display the first line of the error message. I would like to turn this:
Message=Error approving item on orderdetail.aspx.
Exception: Thread was being aborted.
Stack Trace:
at System.Threading.Thread.AbortInternal()
at System.Threading.Thread.Abort(Object stateInfo)
into this:
Message=Error approving item on oderdetail.aspx.
How can I trim the text of the Message field after the new line?
Try like this
your base search | rex field=error_message "^(?<error_message>[^\r\n]+)"
Try this in your search:
| rex field=_raw "^Message=(?<TrimedMessage>[^\n]+\n)"
Then, you can display the the first line of the error message by "TrimedMessage" defined above.
When I do that and do timechart by TrimedMessage I only get NULL returned.
| rex field=_raw "^Message=(?[^\r\n]+)"
Sorry, should be like this.
Or, you can try:
| rex field=_raw "^Message=(?.+)"
Try like this
your base search | rex field=error_message "^(?<error_message>[^\r\n]+)"
That does the trick! Thank you.
Incidentally, can you point me to some documentation about what the different variables mean in the rex expression? Or just a quick programming -> English translation?
I assume ? is the variable of the content of the error Message, and \r\n is a carriage return new line, but what do the ^ and + represent?