topic Re: How can I extract the 3 or 5 digit number and 2 3-letter words after "Request" in my sample log? in Splunk Search

How can I extract the 3 or 5 digit number and 2 3-letter words after "Request" in my sample log?

kostasKats — Mon, 15 Jun 2015 13:01:13 GMT

The log is:

2015-06-15 15:50:29,381 ws prd 62 WARN  JourneySearch # # # # Blocked Incoming Request 13360-PSA-LIS

I have used this for the 3/5 digit number, but I want know to extract the words after the number:

rex field=_raw " Blocked Incoming Request (?<aid>\d+)"

Can someone help me please?

woodcock — Mon, 15 Jun 2015 13:15:31 GMT

Like this:

rex field=_raw " Blocked Incoming Request (?<aid>d+)(?<theRest>.*)$"

reed_kelly — Mon, 15 Jun 2015 13:17:15 GMT

You can also get the words as a multi-valued result and separate them as needed with mvexpand

|rex field=_raw "Request (?<aid>\d+)\-(?<words>\S+)"  |makemv delim="-" words |mvexpand words

kostasKats — Mon, 15 Jun 2015 13:31:24 GMT

Thank you very much all!

This worked perfect for my work:
"Blocked Incoming Request" |rex field=_raw "Request (?\d+)-(?\S+)" |stats count by aid, word

woodcock — Tue, 16 Jun 2015 16:36:33 GMT

You also need max_match=0 like this:

|rex max_match=0 field=_raw "Request (?\d+)\-(?\S+)"  |makemv delim="-" words |mvexpand words