Experiencing rex extract errors with random pattern

[indeed_2000]

Hi

I have list of error codes that available here:
https://www.ibm.com/docs/en/ibm-mq/9.1?topic=exceptions-jms-exception-messages

How can I extract and show them on timechart?

what is the best way to do this? i mean when we have list of different error codes and doen't extract them one by one.

FYI1: as I see unique errors keyword in this senario are:

AMS JMSWMQ MQJCA MQJMS JMSXY JMSMQ JMSIC JMSFMQ JMSCS JMSCMQ JMSCC JMSBM

FYI2: these errors are random not fix pattern that extract them easily, some time locate in first part of each line sometimes locate in middle sometime in end.

Any idea?

Thanks

Thanks

[ITWhisperer]

Please can you share some events (in a code block </> for easier copying into sample searches) with some examples of the error codes you are trying to extract?

[indeed_2000]

there are lot's of different patternt I'm looking for way to find these keywords:

AMS JMSWMQ MQJCA MQJMS JMSXY JMSMQ JMSIC JMSFMQ JMSCS JMSCMQ JMSCC JMSBM

within number after that like these JMSCC0031 or  JMSCC0038, and extract them in a field.

is it possible to do this without consider any string before and after that in splunk?

Thanks

[ITWhisperer · Accepted solution]

| rex "(?<errorcode>(AMS|JMSWMQ|MQJCA|MQJMS|JMSXY|JMSMQ|JMSIC|JMSFMQ|JMSCS|JMSCMQ|JMSCC|JMSBM)\d+)"