Splunk Search

How to retrieve information behind java.lang using rex?

SebBNP
Engager

Hi,

I am trying to retrieve the information behind the value "at java.lang. ..."

I tried the following command but without result :

java.lang | rex field=_raw  "at java.lang. (?.*)"

Example :

2016-11-25T01:13:01.393Z ERROR 15204582 --- [][][] --- [DiscoveryClient-HeartbeatExecutor-0] com.netflix.discovery.DiscoveryClient    : DiscoveryClient_OAUTH/Server:oauth:port(-1655386256) - was unable to send heartbeat!
com.netflix.discovery.shared.transport.TransportException: Cannot execute request on any known server
    at com.netflix.discovery.shared.transport.decorator.RetryableEurekaHttpClient.execute(RetryableEurekaHttpClient.java:111) ~[eureka-client-1.4.6.jar!/:1.4.6]
    at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89) ~[eureka-client-1.4.6.jar!/:1.4.6]
    at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$3.execute(EurekaHttpClientDecorator.java:92) ~[eureka-client-1.4.6.jar!/:1.4.6]
    at com.netflix.discovery.shared.transport.decorator.SessionedEurekaHttpClient.execute(SessionedEurekaHttpClient.java:77) ~[eureka-client-1.4.6.jar!/:1.4.6]
    at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89) ~[eureka-client-1.4.6.jar!/:1.4.6]
    at com.netflix.discovery.DiscoveryClient.renew(DiscoveryClient.java:827) ~[eureka-client-1.4.6.jar!/:1.4.6]
    at com.netflix.discovery.DiscoveryClient$HeartbeatThread.run(DiscoveryClient.java:1383) [eureka-client-1.4.6.jar!/:1.4.6]
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:522) [na:1.8.0-internal]
    at java.util.concurrent.FutureTask.run(FutureTask.java:277) [na:1.8.0-internal]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1153) [na:1.8.0-internal]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [na:1.8.0-internal]
    at java.lang.Thread.run(Thread.java:785) [na:1.8.0-internal]

Thanks for your help.

0 Karma
1 Solution

sundareshr
Legend

Try this

... | rex "java\.lang\.(?<jl>[^\n\t]*)" | table jl

View solution in original post

0 Karma

sundareshr
Legend

Try this

... | rex "java\.lang\.(?<jl>[^\n\t]*)" | table jl
0 Karma

SebBNP
Engager

It's perfect. Thanks

0 Karma

sundareshr
Legend

@SebBNP if this worked for you, please mark the question as answered so it can be closed.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...