Hi,
I need to extract the 3 different certificate errors below into a single field called CertErrors within a Splunk query as part of a saved search. The regex needs to extract from the final colon after 0126006:4: Peer cert verify error up to the first (
01260006:4: Peer cert verify error: certificate has expired (depth 0
01260006:4: Peer cert verify error: certificate revoked (depth
01260006:4: Peer cert verify error: unable to get local issuer certificate (depth)
Thanks
hi
Try this:
|rex max_match=0 "error:\s(?<CertErrors>[^(]+)"
Run this anywhere search:
|makeresults|eval _raw="01260006:4: Peer cert verify error: certificate has expired (depth 0
01260006:4: Peer cert verify error: certificate revoked (depth
01260006:4: Peer cert verify error: unable to get local issuer certificate (depth"
|rex max_match=0 "error:\s(?<CertErrors>[^(]+)"
hi
Try this:
|rex max_match=0 "error:\s(?<CertErrors>[^(]+)"
Run this anywhere search:
|makeresults|eval _raw="01260006:4: Peer cert verify error: certificate has expired (depth 0
01260006:4: Peer cert verify error: certificate revoked (depth
01260006:4: Peer cert verify error: unable to get local issuer certificate (depth"
|rex max_match=0 "error:\s(?<CertErrors>[^(]+)"
Perfect, thanks.