topic Re: How to write the regex to extract the error code from my sample log? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-error-code-from-my-sample/m-p/132279#M36074 <P>Thanks a lot guys! I will surely try it today.</P> Thu, 23 Jul 2015 20:01:26 GMT swapnilkale 2015-07-23T20:01:26Z How to write the regex to extract the error code from my sample log? https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-error-code-from-my-sample/m-p/132276#M36071 <P>How can I find all the error codes from the logs and show it as interesting field? <BR /> e.g. <CODE>Message : Information with Insured. (PL200XXX)</CODE><BR /> Here PLXXXXX is the error code within the parentheses. What regex or search criteria should I use to make this work? I am new to Splunk and exploring it.</P> <P>Thanks a lot for your help.<BR /> Swap</P> Wed, 22 Jul 2015 13:44:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-error-code-from-my-sample/m-p/132276#M36071 swapnilkale 2015-07-22T13:44:53Z Re: How to write the regex to extract the error code from my sample log? https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-error-code-from-my-sample/m-p/132277#M36072 <P>This one is pretty simple.</P> <PRE><CODE>sourcetype=yoursourcetype | rex field=_raw "\((?&lt;errorcode&gt;[^)]+)\)" </CODE></PRE> <P>This should give you the results you want in <CODE>errorcode</CODE>. This is a very quick regex - if you are going to make it "production ready", don't use rex, use the props/transforms to pull it automatically.</P> Wed, 22 Jul 2015 13:54:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-error-code-from-my-sample/m-p/132277#M36072 alacercogitatus 2015-07-22T13:54:13Z Re: How to write the regex to extract the error code from my sample log? https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-error-code-from-my-sample/m-p/132278#M36073 <P>Try:<BR /> If the error code always starts with PL and there are other values between ( ) in your data.<BR /> .. | rex "\((?&lt;err_code&gt;PL\w+)\)"</P> <P>Good Luck!</P> Wed, 22 Jul 2015 19:18:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-error-code-from-my-sample/m-p/132278#M36073 edrivera3 2015-07-22T19:18:14Z Re: How to write the regex to extract the error code from my sample log? https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-error-code-from-my-sample/m-p/132279#M36074 <P>Thanks a lot guys! I will surely try it today.</P> Thu, 23 Jul 2015 20:01:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-the-error-code-from-my-sample/m-p/132279#M36074 swapnilkale 2015-07-23T20:01:26Z