Error when trying to extract fields

[mcg_connor]

I currently am trying to extract the externalDropshipId from the following log

 "updatedTimestamp" : "2019-12-23T20:43:04.774Z",
  "fulfillmentOrderId" : "124B27HTRBRZC9L6P9KL7GC968",
  "externalOrderId" : "9163225842155",
  "externalDropshipId" : "6372205554",

I am using the field extractor and selecting externalDropshipID as the required text and 6372205554 as the field.

This is resulting in the following error..
The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.

How would I go about fixing this?

Thanks

[mydog8it · Accepted solution]

try replacing the regex in the field extractor with this:

externalDropshipId\W\s:\s"(?<externalDropshipId>\d+)"

[mcg_connor]

Thanks! Seems I should start learning regex's instead of relying on the Splunk extractor

[mydog8it]

regex101.com is a great site to test regex between that and the Splunk Quick Reference available here-->>
Splunk Quick Reference

You can get a start developing more complex field extractions than the field extractor was meant to provide.