This is the text which is being print in our app logs :
throws abc.xyz.error.AppException,java.rmi.RemoteException, with 1 error(s): [Error in object 'MyAccountRQ': codes [Password must not contain spaces and must have 6-30 characters.MyAccountRQ,Password must not contain spaces and must have 6-30 characters];
the text in the [text] bracket could be different errors, I need to print it as" codes [] " in format.
Can anyone please help I tried with simple search query with but that doesn't serves the purpose.
Please help, I am a learner of splunk.
Hi
Try this
| makeresults
| eval test="throws abc.xyz.error.AppException,java.rmi.RemoteException, with 1 error(s): [Error in object 'MyAccountRQ': codes [Password must not contain spaces and must have 6-30 characters.MyAccountRQ,Password must not contain spaces and must have 6-30 characters];"
| rex field=test "codes\s+\[(?P<Codes>[^\]]+)"