Extract field

[Sekhar]

Log like.

message: [22/09/23 10:31:47:935 GMT] [ThreadPoolExecutor-thread-15759] INFO failed.", suspenseAccountNumber="941548131", suspenseAccountBSB="083021", timeCreate

as OTHER BUSINESS REASON returned by

CBIS.", debtor RoutingType="BBAN", debtor Routing Id="013013", creditor RoutingType="BBA

6899-422f-8162-6911da94e619", transactionTraceIdentification-1311b8a21-6d6c-422b-8

22T10:31:42.8152_00306", instrId="null", interactionId="null", interactionOriginators tx_uid-ANZBAU3L_A_TST01_ClrSttlmve01_2023-09-22T10:31:42.8152 00306, txId-ANZBAU3L priority-NORM, addressingType=noAlias, flow-N5XSuspense.receive]

How extract the transactionTraceIdentification filed 

I tried already rex field= message "transactionTraceIdentification=\"(?<transactionTraceIdentification>.*?)\","

Not extraxted the vaule

[Sekhar]

I tried getting empty 

[yeahnah]

Likely message is not an extracted field then. 

Try this to extract from the _raw event

| rex field=_raw "transactionTraceIdentification-(?<transactionTraceIdentification>[^\"]+)

[inventsekar]

Hi @Sekhar your one line reply will not help us to help you.. pls write your full search query.. 

provide some more sample log lines.. 

[inventsekar]

Hi @Sekhar ... pls provide some more log lines.. 

pls check this rex.. 

Splunk newbie learning videos, for absolute beginners:
https://www.youtube.com/@SiemNewbies101/playlists

i have added 24 small videos of rex... completely for splunk newbies and beginners.

source="rex.txt" host="laptop" sourcetype="rextest" | rex field=_raw "transactionTraceIdentification\-(?<transactionTraceIdentification>.*)" | table _raw transactionTraceIdentification

[yeahnah]

Hi @Sekhar 

try this..

| rex field=message "transactionTraceIdentification-(?<transactionTraceIdentification>[^\"]+)"

hope that helps