topic How do I extract a substring beginning by some characters and ending by : in Splunk Search

How do I extract a substring beginning by some characters and ending by :

proussinbnc — Fri, 05 Mar 2021 15:45:58 GMT

Hi,

I have this in my message string:

Errors in file /u02/app/oracle/diag/rdbms/pwein1a/pwein1a1/trace/pwein1a1_cjq0_287471.trc: ORA-12850: Could not allocate slaves on all specified instances: needed, allocated

ORA-16401: archive log rejected by Remote File Server (RFS)

I would like to extract in a search only the substring: ORA-nnnnn

Any ideas, I tried every solution available here in the community. Bu I am fairly new to Splunk.

Thanks Pierre

Re: How do I extract a substring beginning by some characters and ending by :

inventsekar — Fri, 05 Mar 2021 16:03:24 GMT

Hi, You can use rex command...

|makeresults | eval _raw="pwein1a1_cjq0_287471.trc: ORA-12850: Could not allocate" | rex field=_raw "(?<oraNum>ORA-\d+)\:" | table _raw oraNum

if this solves your query, pls accept this as solution, upvote is appreciated, thanks.

Re: How do I extract a substring beginning by some characters and ending by :

proussinbnc — Fri, 05 Mar 2021 16:24:51 GMT

Thanks a lot !