I currently am trying to extract the externalDropshipId from the following log
"updatedTimestamp" : "2019-12-23T20:43:04.774Z", "fulfillmentOrderId" : "124B27HTRBRZC9L6P9KL7GC968", "externalOrderId" : "9163225842155", "externalDropshipId" : "6372205554",
I am using the field extractor and selecting
externalDropshipID as the required text and
6372205554 as the field.
This is resulting in the following error..
The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.
How would I go about fixing this?
regex101.com is a great site to test regex between that and the Splunk Quick Reference available here-->>
Splunk Quick Reference
You can get a start developing more complex field extractions than the field extractor was meant to provide.