Can you help me to extract a specific event from a log?

[jip31]

Hello

In a report, i used the code below in order to search for an error code in my events.

But, when a code is found, i want to display the complete line event and not only the code error.

index=main sourcetype="applog"  | rex "Failed Error code : (?<ErrorCode>.*)" |table host ErrorCode

Thanks in advance for your help.

[mstjohn_splunk]

@jip31

Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

[richgalloway · Accepted solution]

Depending on what exactly you're trying to do, there's a few ways to do it.

index=main sourcetype="applog" "Failed Error code : "

index=main sourcetype="applog"  | regex "Failed Error code :"

index=main sourcetype="applog"  | rex "Failed Error code : (?<ErrorCode>.*)" | table host ErrorCode _raw