please suggest regex

[bhaskar5428]

Process transaction locally [idempotencyId=27cb55d0-3844-4e8f-8c4b-867ed64610a220240821034250387S39258201QE, deliveringApplication=MTNA0002, orderId=8e1d1fc0-5fe2-4643-bc1f-12debe6a7a06]

i would like to extract Order Id from above sample data 

which is = 8e1d1fc0-5fe2-4643-bc1f-12debe6a7a06

Pls suggest

[gcusello]

Hi @bhaskar5428 ,

it should be already extracted because Splunk recognizes the pais:field=value; anyway, you could try this regex:

orderId\=(?<orderId>[^\]]+)

that you can test at https://regex101.com/r/OtSfRS/1

Ciao.

Giuseppe 

[ITWhisperer]

orderId=(?<orderid>[^\]]+)\]