https://community.splunk.com/t5/All-Apps-and-Add-ons/field-extractor/m-p/43375#M2188 <P>Wondering if this works. </P> <PRE><CODE>.. | rex field=_raw "\(AR\S+\s+(?&lt;error&gt;[^\)]+)\)" </CODE></PRE> Tue, 26 Feb 2013 05:30:59 GMT tgow 2013-02-26T05:30:59Z https://community.splunk.com/t5/All-Apps-and-Add-ons/field-extractor/m-p/43374#M2187 <P>Fri Feb 22 20:52:59 2013 390603 : Failure during SQL operation to the database : ORA-00942: table or view does not exist (ARERR 552)<BR /> Fri Feb 22 20:52:59 2013 390603 : Failure during SQL operation to the database : ORA-00942: table or view does not exist (ARERR 552)<BR /><BR /> Fri Aug 31 16:54:19 2012 Sig-Cancelled - AP:Signature - 000000000031602|000000000017692<BR /> Fri Aug 31 16:54:19 2012 Approve : Operation cancelled due to error (ARAPPNOTE 4502)<BR /><BR /> Fri Aug 31 16:54:19 2012 Sig-Cancelled - AP:Signature - 000000000023551|000000000014287 <BR /> Fri Aug 31 16:54:19 2012 Approve : Operation cancelled due to error (ARAPPNOTE 4502)</P> <P>is the sample data. looking to extract only last field within ( ) error code and the text before it starting from :.*(AR* 111)<BR /> tried several rex and extraction as the data but no luck. </P> <P>looking for help</P> <P>thanks</P> <P>Sri</P> Tue, 26 Feb 2013 05:04:44 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/field-extractor/m-p/43374#M2187 sri777 2013-02-26T05:04:44Z https://community.splunk.com/t5/All-Apps-and-Add-ons/field-extractor/m-p/43375#M2188 <P>Wondering if this works. </P> <PRE><CODE>.. | rex field=_raw "\(AR\S+\s+(?&lt;error&gt;[^\)]+)\)" </CODE></PRE> Tue, 26 Feb 2013 05:30:59 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/field-extractor/m-p/43375#M2188 tgow 2013-02-26T05:30:59Z