I have raw message of the form...
2022-08-15T10:41:54.266337+00:00 microService 9bc7520a-4f8d-4edc-a4cd-b08c0fae8992[[APP/PROC/WEB/2]] APPENDER=APP, DATE=2022-08-15 10:41:54.266, LEVEL=WARN , USER=, THREAD=[pool-25-thread-1], LOGGER=Factory, CORR=, INT_CORR=, X-VCAP-REQUEST-ID=, MESSAGE=warningMessage
What's the rex syntax to return microService AND warningMessage?
Field names are case sensitive so microService is not the same as microservice (the name of the field in the rex extract)
| rex "^\S+\s(?<microservice>\S+).*MESSAGE=(?<message>.+)"
Tried....
index=splunkIndex "*LEVEL=WARN*" | rex "^\S+\s(?<microservice>\S+).*MESSAGE=(?<message>.+)" | table _raw, microService, message
...and I see the message but NOT the microservice
FYI the returned _raw message starts...
2022-08-15T10:53:25.650962+00:00 microService
Field names are case sensitive so microService is not the same as microservice (the name of the field in the rex extract)
Thank you - that worked!