How can I trim a string after a new line?

[dsapergia]

I have a search that returns events from an error log. I would like to do a timechart sorted by error Message.

However I only want to display the first line of the error message. I would like to turn this:

Message=Error approving item on orderdetail.aspx.
Exception: Thread was being aborted.
Stack Trace:
at System.Threading.Thread.AbortInternal()
at System.Threading.Thread.Abort(Object stateInfo)

into this:
Message=Error approving item on oderdetail.aspx.

How can I trim the text of the Message field after the new line?

[ChrisYang]

Try this in your search:

| rex field=_raw "^Message=(?<TrimedMessage>[^\n]+\n)" 

Then, you can display the the first line of the error message by "TrimedMessage" defined above.

[dsapergia]

When I do that and do timechart by TrimedMessage I only get NULL returned.

[ChrisYang]

| rex field=_raw "^Message=(?[^\r\n]+)"

Sorry, should be like this.

Or, you can try:
| rex field=_raw "^Message=(?.+)"

[somesoni2 · Accepted solution]

Try like this

your base search | rex field=error_message "^(?<error_message>[^\r\n]+)"

[dsapergia]

That does the trick! Thank you.

Incidentally, can you point me to some documentation about what the different variables mean in the rex expression? Or just a quick programming -> English translation?

I assume ? is the variable of the content of the error Message, and \r\n is a carriage return new line, but what do the ^ and + represent?