topic Re: Fetch incident from subject in Splunk Search

Fetch incident from subject

priya0709 — Thu, 20 Aug 2020 05:24:02 GMT

I am using below query to fetch Incident from the subject line:—

rex field=subject max_match=0 “(?<Incident>INC\d+)”

however, for below subject line i am unable to fetch incident:—

[SecMail:] INC000027755501|TAS00003760220 wrdna904xusa73|server is unreachable | INC000027790458| INC000027882562

Re: Fetch incident from subject

isoutamo — Thu, 20 Aug 2020 12:19:02 GMT

I think that this is duplicate question to

https://community.splunk.com/t5/Splunk-Search/Regex-help-for-incident/m-p/515131#M144610

basically your issue seems to be wrong “ and ”. Otherwise your query is working as expected just switch both of those to ".

r. Ismo

Re: Fetch incident from subject

priya0709 — Fri, 21 Aug 2020 07:05:22 GMT

thank you for your reply!!

however, My query

rex field=subject max_match=0 "(?<Incident>INC\d+)"

works fine for Eg1 in which INC is appended by space in subject line. however, for eg2 INC is appended by | in this case Incident number is not fetched.

eg 1:- RE: INC0000756784 | server is unreachable

eg 2:- RE:INC0000564789|Minor|server unreachable

Re: Fetch incident from subject

isoutamo — Fri, 21 Aug 2020 12:01:09 GMT

When I just made copy & paste from my previous example and then copy & paste both of your examples (one by one), both are working.

I suppose that you still have some issue with " or something similar.

r. Ismo

Re: Fetch incident from subject

thambisetty — Fri, 21 Aug 2020 12:30:28 GMT

It doesn’t think of other characters. It matches if there is INC FOLLOWED BY 10 digits.