Splunk Search

How to create regex to capture a whole string?

MOHITJOSHI
Engager

I have a big event and I want to capture the string between "Message=" and "UpDocCaseRepository"


in other words i want to capture this specific string--

"Service encountered a database error." InnerMessage="Method Name: LOBCaseService.LoadCaseText, Error Message: Service encountered a database error., Exception: System.Net.Http.HttpRequestException: Cannot get client case document(s). Lob service call was not successful. reasonPhrase=Unauthorized\r\n at .eCAC.Service.CDR._1.Repository.

event-

2022-04-04 21:15:37,734 ERROR WCFServiceClient.Web.InfrastructureService sTime="4/5/2022 1:15:37 AM" LocalId="403654042" Method="LoadCase" Message="Service encountered a database error." InnerMessage="Method Name: LOBCaseService.LoadCaseText, Error Message: Service encountered a database error., Exception: System.Net.Http.HttpRequestException: Cannot get client case document(s). Lob service call was not successful. reasonPhrase=Unauthorized\r\n at .eCAC.Service.CDR._1.Repository.UpDocCaseRepository.<SendUpDocRequest>d__14`1.MoveNext() in s:\jenkins\workspace\_ecac_se---aeddb52c\.eCAC.Service.CDR\1.Repository\UpDocCaseRepository.cs:line 191\r\n--- End of stack trace from previous location where exception was thrown

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "Message=(?<message>.*?)UpDocCaseRepository"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "Message=(?<message>.*?)UpDocCaseRepository"
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...