Splunk Search

Field Extraction

shivam_j
New Member

Hi All, I want to extract the log to be extracted from error message till : message : , but not getting it, I have tried few queries but I am not getting the desired output:

error message System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The remote name could not be resolved: TimeoutChecklistExecutionResultHandler.cs:line 293 : message : {
Please suggest what query should I choose.
PS: | rex ".(Asterisk)error message (?.(Asterisk)) : message : .*" is not working

0 Karma

dindu
Contributor

Hi Shivam,

We could use regexes to extract the required values.
All the answers given above will give the desired results.However, it is advisable to achieve in minimum steps and minimum latency.
Otherwise it will have an impact on performance.

You could check your regex in https://regex101.com/ and look on the top middle to see the no of steps iterated and time consumed.
Its better not to include too much identifier for matching, as it will impact the performance.

I would suggest to go with the below regex which only took 46 steps- considering the key identifiers to be the words error message and message.
Your overall query becomes .

|Your_search
|rex field = _raw  "error\smessage(?P<exception_message>.*)message"
| table exception_message

Please accept and upvote the answer if this helped you.
Happy Splunking!!

shivam_j
New Member

Hi Dindu, unfortunately, the log already contains 'message' keyword in between (which i skipped in the log i mentioned in the que. otherwise it would get long). So, this won't work. Thanks for the answer bdw.

0 Karma

Anantha123
Communicator

Hi Try this

| rex field=_raw "error\smessage\s(?P<ErrorMessage>.*)\s:\smessage\s" | table ErrorMessage

uagrawal_splunk
Splunk Employee
Splunk Employee

Try the below query
error message .*(?=(: message :))

0 Karma

mayurr98
Super Champion

try this:

| makeresults 
|  eval _raw="error message System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The remote name could not be resolved: TimeoutChecklistExecutionResultHandler.cs:line 293 : message : {" 
|  rex  "error\s+message\s+(?<Message>.+?(?=(\:\s+message\s+\:)))"
0 Karma

uagrawal_splunk
Splunk Employee
Splunk Employee

I tried the query in regex101 and it takes 650 steps to match the regex. And the same query with little modification takes the 78 steps to match the regex. Here is the query:

error\s+message\s+(?<Message>.*(?=(\:\s+message\s+\:)))

0 Karma

mayurr98
Super Champion

yes, there are several ways to solve the same problem but the idea behind it to use Positive Lookahead and Quantifier.

you could also try error\s+message\s+(?<Message>.+(?=(\:\s+message\s+\:)))

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...