How to extract the pattern " [xxxxxxx] ERROR " for splunk?

Question

2013-11-22 08:58:43,724 [pool-2-thread-2] ERROR org.apache.catalina.loader.WebappClassLoader- The web application [/probe] appears to have started a thread named [scheduler_Worker-4] but has failed to stop it. This is very likely to create a memory leak.

2013-11-22 08:58:43,495 [pool-2-thread-2] ERROR org.apache.catalina.loader.WebappClassLoader- The web application [/ults] created a ThreadLocal with key of type [com.opensymphony.xwork2.inject.ContainerImpl$10] (value [com.opensymphony.xwork2.inject.ContainerImpl$10@188bf463]) and a value of type [java.lang.Object[]] (value [[Ljava.lang.Object;@18be8037]) but failed to remove it when the web application was stopped. Threads are going to be renewed over time to try and avoid a probable memory leak.

I want to extract the pattern string "[xxxxxxxxxxxxx] ERROR " , but don't know what is the rex?

Answer 1

This is the regex you need:

\[[^\]]*] ERROR