https://community.splunk.com/t5/Alerting/How-to-create-query-to-track-multiple-ORA-numbers-we-received/m-p/608245#M14110 <P>I want to track multiple ORA numbers, we received different format logs as below, can you help me to write a query for this.</P> <P>&nbsp;</P> <P>Logs/Events:</P> <P>&nbsp;</P> <P>2022-08-04T06 : 55 : 54.009110 + 01 : 00 opiodr aborting process unknown ospid ( 8696 ) as a result of ORA - 609</P> <P>2022-08-04T06 : 51 : 54.137474 + 01 : 00 WARNING : inbound connection timed out ( ORA - 3136 )</P> Thu, 04 Aug 2022 14:46:07 GMT jackin 2022-08-04T14:46:07Z https://community.splunk.com/t5/Alerting/How-to-create-query-to-track-multiple-ORA-numbers-we-received/m-p/608245#M14110 <P>I want to track multiple ORA numbers, we received different format logs as below, can you help me to write a query for this.</P> <P>&nbsp;</P> <P>Logs/Events:</P> <P>&nbsp;</P> <P>2022-08-04T06 : 55 : 54.009110 + 01 : 00 opiodr aborting process unknown ospid ( 8696 ) as a result of ORA - 609</P> <P>2022-08-04T06 : 51 : 54.137474 + 01 : 00 WARNING : inbound connection timed out ( ORA - 3136 )</P> Thu, 04 Aug 2022 14:46:07 GMT https://community.splunk.com/t5/Alerting/How-to-create-query-to-track-multiple-ORA-numbers-we-received/m-p/608245#M14110 jackin 2022-08-04T14:46:07Z https://community.splunk.com/t5/Alerting/How-to-create-query-to-track-multiple-ORA-numbers-we-received/m-p/608258#M14111 <P>Hello&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/239496">@jackin</a>&nbsp;,</P><P>You can write the below query to your base search to extract the ORA field.</P><LI-CODE lang="markup">| &lt;your_base_query&gt; | rex field=_raw "(ORA - )(?P&lt;ORA&gt;\d+)"</LI-CODE><P>&nbsp;</P><P>---</P><P>If you find this answer helpful, an upvote is appreciated..!!</P> Thu, 04 Aug 2022 11:52:37 GMT https://community.splunk.com/t5/Alerting/How-to-create-query-to-track-multiple-ORA-numbers-we-received/m-p/608258#M14111 tej57 2022-08-04T11:52:37Z