How to extract the pattern " [xxxxxxx] ERROR " for splunk?

StackOverflow https://stackoverflow.com/questions/20366492

  •  28-08-2022
  •  | 
  •  

Question

2013-11-22 08:58:43,724 [pool-2-thread-2] ERROR org.apache.catalina.loader.WebappClassLoader- The web application [/probe] appears to have started a thread named [scheduler_Worker-4] but has failed to stop it. This is very likely to create a memory leak.

2013-11-22 08:58:43,495 [pool-2-thread-2] ERROR org.apache.catalina.loader.WebappClassLoader- The web application [/ults] created a ThreadLocal with key of type [com.opensymphony.xwork2.inject.ContainerImpl$10] (value [com.opensymphony.xwork2.inject.ContainerImpl$10@188bf463]) and a value of type [java.lang.Object[]] (value [[Ljava.lang.Object;@18be8037]) but failed to remove it when the web application was stopped. Threads are going to be renewed over time to try and avoid a probable memory leak.

I want to extract the pattern string "[xxxxxxxxxxxxx] ERROR " , but don't know what is the rex?

Was it helpful?

Solution

This is the regex you need:

\[[^\]]*] ERROR
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top