Generic search to pull Job Name

[harsush]

20170221/032119.169 - U0020408 UC4ALERT: External Dependency inside jobplan NEWREL.JOBPLAN.X. CLEAN.SET_PARA.RTH_FOR_LOAD, (Run # 22222222) has been executing longer than expected; Please investigate.

20170221/010037.065 - U0011544 Max. runtime of task 'NEWREL.FILEEVNT.U.CLEAN.FIX.LOOK_FOR_IMR_FILE_IN_FTP' (RunID '11111111') has been exceeded. Task 'SYSTEM.SCRIPT.X.UC4.X.OBJ_RUNNING_TOO_LONG' will be started.

20170221/020123.758 - U0011007 Job 'CERT.JOBS.U.CVR.POS.CYC_DATE_LOAD' (RunID '444444444' / Workflow-RunID: '333333333') on Host 'CLCEPOS0001LD' ended abnormally (return code='0000000001'). Remote ID=13388

output
NEWREL.JOBPLAN.X. CLEAN.SET_PARA.RTH_FOR_LOAD
NEWREL.FILEEVNT.U.CLEAN.FIX.LOOK_FOR_IMR_FILE_IN_FTP
CERT.JOBS.U.CVR.POS.CYC_DATE_LOAD

[adayton20]

This seemed to work for me. Give it a try:

index=yourindex
| rex field=_raw "jobplan\s(?P<job1>.[^\,]*)" 
| rex field=_raw "task\s\'(?P<job2>.[^\']*)" 
| rex field=_raw "Job\s\'(?P<job3>.[^\']*)" 
| eval job=coalesce(job1,job2,job3) 
| table job