Splunk Search

How to write REXG when there is no field

jw44250
New Member

Failed to determine DORG Access: HTTP 413 Request Entity Too Large

pls provide some explain -- how regx works in splunk ...

0 Karma

hortonew
Builder

I have a blog post on this subject: http://blog.hortonew.com/how-to-use-regex-rex-in-splunk

0 Karma

jw44250
New Member

really good blog post thank you --

how to exclude the word exception from below query

this splunk query index = index Exception | rex ".?(?(?:\w+.)+\w?Exception).*"
| stats count by exception

result : Uncaught exception: no Access Rule found for key ---
java.lang.exception ..

this query catches the word exception as well but i'm not interested in work exception --
i am interested the following

java.io.IOException

java.lang.Exception

java.lang.IllegalAccessException

java.lang.reflect.InvocationTargetException
java.lang.RuntimeException
java.net.ConnectException,
java.net.SocketException
java.rmi.NoSuchObjectException

java.util.MissingResourceException

javax.ejb.NoSuchEJBException

javax.faces.application.ViewExpiredException
javax.faces.FacesException

0 Karma

jw44250
New Member

regx field = _row "Failed*(?i

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...