https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284503#M86052 <P>i believe you missanderstood, it´s right if an event does not contain the Audit Id field rex will fail to find it, this is a normal behavior. But if i have 100 Events in summary and 10 of them contains the Audit ID i would like to have the new field auditID with 80 NULL values and 10 correct matches. </P> Thu, 02 Jun 2016 08:22:59 GMT nikkkc 2016-06-02T08:22:59Z https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284498#M86047 <P>hi,<BR /> would someone be so kind and help me to build a rex expression? i want to extract all "Audit ID" from this sample Log:</P> <P>May 31 17:36:05 xxx.xxx.xxx.xxx May 31 17:37:04 mail33 ecelerity[23851]: ML-REJECT: Rejection on: xxx.x.xx.x:25, sent to host: 111.1111.111.111:56482, Audit ID ac13e885-1234567-32-574dafa09655, 554 5.7.1 You are not allowed to connect.#015 </P> <P>i want the hole text after the "Audit ID" string until the next comma.<BR /> Thanks in advanced</P> Tue, 31 May 2016 16:20:51 GMT https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284498#M86047 nikkkc 2016-05-31T16:20:51Z https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284499#M86048 <P>...and i have to search for "Audit ID" because the ID is not always on the same place! i tried a lot but nothing works</P> Tue, 31 May 2016 16:23:19 GMT https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284499#M86048 nikkkc 2016-05-31T16:23:19Z https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284500#M86049 <P>This works on regex101.com with your sample event.</P> <PRE><CODE>... | rex "Audit ID (?&lt;auditID&gt;[^,]*)" | ... </CODE></PRE> Tue, 31 May 2016 16:56:26 GMT https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284500#M86049 richgalloway 2016-05-31T16:56:26Z https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284501#M86050 <P>Thank you, this is exactly what i had, but now i realized the real problem: I forgot to mention that there are a lot of Events without the Audit ID and then it doesnt work. In approx. 200 Events the Audit ID is present just a few times. If i pre-filter the Events then the rex works !! <BR /> i do not understand this behaivor... </P> Wed, 01 Jun 2016 07:11:01 GMT https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284501#M86050 nikkkc 2016-06-01T07:11:01Z https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284502#M86051 <P>If an event does not contain the Audit ID field then rex will fail to find it. Any part of your query which relies on the Audit ID field will also fail. </P> <P>The presence of the Audit ID field in a event is controlled by the application, not by Splunk.</P> Wed, 01 Jun 2016 17:31:59 GMT https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284502#M86051 richgalloway 2016-06-01T17:31:59Z https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284503#M86052 <P>i believe you missanderstood, it´s right if an event does not contain the Audit Id field rex will fail to find it, this is a normal behavior. But if i have 100 Events in summary and 10 of them contains the Audit ID i would like to have the new field auditID with 80 NULL values and 10 correct matches. </P> Thu, 02 Jun 2016 08:22:59 GMT https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284503#M86052 nikkkc 2016-06-02T08:22:59Z https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284504#M86053 <P>Ah. Then you would want the <CODE>fillnull</CODE> command.</P> Thu, 02 Jun 2016 12:40:30 GMT https://community.splunk.com/t5/Splunk-Search/rex-extraction-for-field-value-with-space/m-p/284504#M86053 richgalloway 2016-06-02T12:40:30Z