Fetching alphanumeric value and numeric values in aline

[Arani_Hari]

How to extract alphanumeric and numeric values from aline,  both are dynamic values

<Alphanumeric>_ETC_RFG: play this message: announcement/<numeric>

[Arani_Hari]

I tried below syntax but it's matching entire line but I want only "ID" value /(?<ID>\w+)_ETC_RFG

[bowesmana]

Can you share your SPL and data. This example works

| makeresults
| eval line="SOMEALPHA9876NUMERIC_ETC_RFG: play this message: announcement/12345678"
| rex field=line "(?<ID>\w+)_ETC_RFG:.*/(?<NUM>\d+)"

[Arani_Hari]

log line will be

05:02:05.213 Txt 46000 008a456b37de5982_ETC_RFG: (Q056) play this message id:announcement/4637825, duration:58

expecting Table like

008a456b37de5982 ETC RFG 4637825

[ITWhisperer]

You are not really giving us sufficient information. The rex command that @bowesmana provided extracts the alphanumeric and numeric as you asked. Your "table" doesn't identify what the columns are called. Are ETC and RFG fixed non-varying constant strings? Do these need to be in separate fields in the table? Please clarify your requirement, although, tbh, you already appear to have been given a workable solution.

[Arani_Hari]

sorry, if i confused. Yes, ETC and RFG are fixed and need to add in table

Log Line:

05:02:05.213 Txt 46000 008a456b37de5982_ETC_RFG: (Q056) play this message id:announcement/4637825, duration:58

i tired to get result with below query,  but not working properly 

index=dg_hdgf_yrgt "(Q056) play this message" | rex field=_raw "Txt\s+46000\s+(?<IDvalue>\w+)" | rex field=_raw "announcement/(?<messagefile>\d+)"
| where NOT isnull(messagefile)
| mvexpand IDvalue
| makemv IDvalue delim="_"
| eval IDvalue=mvindex(IDvalue,0)
| eval ENV=mvindex(IDvalue,1)
| eval LOB=mvindex(IDvalue,2)
| search LOB=RFG
| table IDvalue,ENV,LOB,messagefile

[ITWhisperer]

| rex field=line "(?<ID>\w+)_ETC_RFG:.*/(?<NUM>\d+)"
| eval ETC="ETC", RFG="RFG"

[ITWhisperer]

regex101.com is a good site for testing regex