field extractor

[sri777]

Fri Feb 22 20:52:59 2013 390603 : Failure during SQL operation to the database : ORA-00942: table or view does not exist (ARERR 552)
Fri Feb 22 20:52:59 2013 390603 : Failure during SQL operation to the database : ORA-00942: table or view does not exist (ARERR 552)

Fri Aug 31 16:54:19 2012 Sig-Cancelled - AP:Signature - 000000000031602|000000000017692
Fri Aug 31 16:54:19 2012 Approve : Operation cancelled due to error (ARAPPNOTE 4502)

Fri Aug 31 16:54:19 2012 Sig-Cancelled - AP:Signature - 000000000023551|000000000014287
Fri Aug 31 16:54:19 2012 Approve : Operation cancelled due to error (ARAPPNOTE 4502)

is the sample data. looking to extract only last field within ( ) error code and the text before it starting from :.*(AR* 111)
tried several rex and extraction as the data but no luck.

looking for help

thanks

Sri

[tgow]

Wondering if this works.

.. | rex field=_raw "\(AR\S+\s+(?<error>[^\)]+)\)"