I have messages like below in logs, I want to extract ErrorCode from Those messages, Here ErrorCode is CIS-46031
However there could be space right after ErrorCode or after ErrorCode:
msg: ErrorCode:CIS-46031,ErrorMessage:Some unknown error occurred in outage daemon request. Please check.,Error occurred in CIS domain events outage processing.
msg: ErrorCode : CIS-46032,ErrorMessage:Some unknown error occurred in outage daemon request.
msg: ErrorCode :CIS-46033, ErrorMessage:Some unknown error occurred in outage daemon request.
How can we do the same in Splunk
Thanks, but I am still getting it as NULL, I have pasted it below
Below is the message (Here there is a space between ErrorCode: and CIS-53030)
msg: ErrorCode: CIS-53030 Events cannot be processed
If ErrorCode: doesn't exist in your events, you will get NULL. Are you expecting all events to have ErrorCode in? If so, can you share some of the events which are not matching the rex?
| rex "ErrorCode\s*:\s*(?<errorcode>[^\s,]+),"
| where isnull(errorcode)
ErrorCode exist in the event, however if there is space, it's returning as null in visualisation, For instance, in below event, we have ErrorCode: CIS-53030 (Here there is space between ErrorCode: and CIS-53030), it's showing as NULL
msg: ErrorCode: CIS-53030 Events cannot be processed as WFM is not provisioned for WFM ID
Try it without the tail anchor ","
| rex "ErrorCode\s*:\s*(?<errorcode>[^\s,]+)"
Thanks a lot, it worked
Thanks @ITWhisperer , It worked
| rex "ErrorCode\s*:\s*(?<errorcode>[^,]+),"
Thanks, it worked, however in visulalization, it prints as NULL if there's a space in between
For instance it prints NULL for ErrorCode: CIS-53030
However if it's ErrorCode: CIS-53031, it prints correct value as ErrorCode: CIS-53031
| rex "ErrorCode\s*:\s*(?<errorcode>[^\s,]+),"