topic Re: please suggest regex in Reporting

please suggest regex

bhaskar5428 — Wed, 21 Aug 2024 08:23:30 GMT

Process transaction locally [idempotencyId=27cb55d0-3844-4e8f-8c4b-867ed64610a220240821034250387S39258201QE, deliveringApplication=MTNA0002, orderId=8e1d1fc0-5fe2-4643-bc1f-12debe6a7a06]

i would like to extract Order Id from above sample data

which is = 8e1d1fc0-5fe2-4643-bc1f-12debe6a7a06

Pls suggest

Re: please suggest regex

ITWhisperer — Wed, 21 Aug 2024 08:39:01 GMT

orderId=(?<orderid>[^\]]+)\]

Re: please suggest regex

gcusello — Wed, 21 Aug 2024 08:40:22 GMT

Hi @bhaskar5428 ,

it should be already extracted because Splunk recognizes the pais:field=value; anyway, you could try this regex:

orderId\=(?<orderId>[^\]]+)

that you can test at https://regex101.com/r/OtSfRS/1

Ciao.

Giuseppe