my event is - "common.exceptions.CommandFailedAtServerException:
concurrent.ExecutionException:
common.SocketPoolException: Unable to connect socket ... 3 lines omitted: java.net.ConnectException: Connection refused ... 8 lines omitted ... common.exceptions.CommandFailedException: "
i want to extract strings "CommandFailedAtServerException, ExecutionException, SocketPoolException java.net.ConnectException CommandFailedException" from the above event under the single filed?
How can i do that?
Like this:
| rex max_match=0 "(?im).*?(?<Exceptions>[\S]*Exception[\S]*)"
Like this:
| rex max_match=0 "(?im).*?(?<Exceptions>[\S]*Exception[\S]*)"
And one more question. I have two source files and they are containing following fields
1.source=Order, fields= Key,Name,Product,Price
2.source=Delivery, fields=Key,Shipdat,delivery location,price,
The data which comes under "Delivery" should fall under "delivered" category for that i have used this join query ""source="Delivery.csv"| eval status="Delivered"|join Key [source=order.csv|]"" and i got the result.
So how to use the join query for the category "Not delivered"
Try this:
source="Delivery.csv" OR source="order.csv" | stats values(*) AS * BY Key | where isnull(delivery)
If that doesn't do it, ask a new question in the forum.
Hi woodcock.. thats really great... could u explain me the logic?
great.. thanks a ton
The rex
command takes the _raw
field and applies the RegEx to it as many times as possible (max_match=0
). The i
is for ignore case
and the m
is for multiline
. we skip as few characters as possible to get to non-whitespace characters that end with "Exception" followed by as many non-whitespace characters as possible (this creates the whitespace boundaries) and we call that captured string Exceptions
.