Try this
index="prod" "Null Pointer Exception" | rex "JSESSIONID\:(?<JSESSIONID>[^\.]+)"
Try this
index="prod" "Null Pointer Exception" | rex "JSESSIONID\:(?<JSESSIONID>[^\.]+)"
Is there a way to capture unique JSESSIONID values?
Do you mean your search result should show one event per JSESSIONID? If yes, then use like this
index="prod" "Null Pointer Exception" | rex "JSESSIONID\:(?<JSESSIONID>[^\.]+)" | dedup JSESSIONID
The 'dedup JSESSIONID' got me unique JSESSIONID values. Thank you @somesoni2 !
Do you mind explaining this part please: "JSESSIONID:(?[^.]+)" ? Does it mean to capture the value after the colon? If yes, and if there was a space after colon, would it have captured that too? How would you ignore the space after the colon?
It's basically everything between JSESSIONID:
and first occurance of dot. It would capture that space as well. To ignore that try this. This will ignore space if present after colon (0 or more occurance of space)
| rex "JSESSIONID\:\s*(?<JSESSIONID>[^\.]+)"