How to extract ErrorCode from log messages using regex?

[dezmadi]

I have  messages like below in logs, I want to extract ErrorCode from Those messages, Here ErrorCode is CIS-46031

However there could be space right after ErrorCode or after ErrorCode:

 msg: ErrorCode:CIS-46031,ErrorMessage:Some unknown error occurred in outage daemon request. Please check.,Error occurred in CIS domain events outage processing.

msg: ErrorCode : CIS-46032,ErrorMessage:Some unknown error occurred in outage daemon request. 

msg: ErrorCode :CIS-46033, ErrorMessage:Some unknown error occurred in outage daemon request. 

How can we do the same in Splunk

[dezmadi]

Thanks, but I am still getting it as NULL, I have pasted it below

Below is the message (Here there is a space between ErrorCode: and  CIS-53030)

  msg: ErrorCode: CIS-53030 Events cannot be processed 

[ITWhisperer]

If ErrorCode: doesn't exist in your events, you will get NULL. Are you expecting all events to have ErrorCode in? If so, can you share some of the events which are not matching the rex?

| rex "ErrorCode\s*:\s*(?<errorcode>[^\s,]+),"
| where isnull(errorcode)

[dezmadi]

ErrorCode exist in the event, however if there is space, it's returning as null in visualisation, For instance, in below event, we have ErrorCode: CIS-53030 (Here there is space between ErrorCode: and CIS-53030), it's showing as NULL

  msg: ErrorCode: CIS-53030 Events cannot be processed as WFM is not provisioned for WFM ID

[ITWhisperer]

Try it without the tail anchor ","

| rex "ErrorCode\s*:\s*(?<errorcode>[^\s,]+)"

[dezmadi]

Thanks a lot, it worked

[dezmadi]

Thanks @ITWhisperer  , It worked

[ITWhisperer · Accepted solution]

| rex "ErrorCode\s*:\s*(?<errorcode>[^,]+),"

[dezmadi]

Thanks, it worked, however in visulalization, it prints as NULL if there's a space in between

For instance it prints NULL for ErrorCode:   CIS-53030

However if it's ErrorCode: CIS-53031, it prints correct value as ErrorCode: CIS-53031

[ITWhisperer]

| rex "ErrorCode\s*:\s*(?<errorcode>[^\s,]+),"