topic Re: Need help in extracting branch numbers from event message in Splunk Search

Need help in extracting branch numbers from event message

labaningombam — Mon, 01 Aug 2022 09:57:28 GMT

I have a field called RenderedMessage in event log which has the following text

Task finished: TaskID 1 for branch 6000

I have been given the task to alert in an email all the branches that has the tasked finished.

In my search, I am able to get the events for this task as

index=prod | spath RenderedMessage | search RenderedMessage="*Task finished: ColleagueNextWeekTask*"

How shall I extract only the branch values from this events/message? I need only the 6000 from this.

Thank you.

Re: Need help in extracting branch numbers from event message

richgalloway — Mon, 01 Aug 2022 12:28:01 GMT

Use the rex command to extract a field from another field (including _raw).

| rex field=RenderedMessage "branch (?<branch>\d+)"

Re: Need help in extracting branch numbers from event message

labaningombam — Mon, 01 Aug 2022 13:25:14 GMT

Thank you so much, @richgalloway It works. Is there a way I can display only the branch after this command without showing count. I can display it with

| stats count by branch

Re: Need help in extracting branch numbers from event message

richgalloway — Mon, 01 Aug 2022 13:38:56 GMT

The table command can do that.

| table branch