Splunk Search

Help extracting alphanumeric string after matching pattern

harishnpandey
Explorer
{"line":"2019-10-05 03:58:11.627 ERROR [xxx-csscsc0sssscs-xxxx] 1 --- [nio-8080-exec-2] c.u.f.b.s.registryImpl  : \u003c\u003c\u003c registryImpl  : registerInformation(): caught NnaException REGISTER_NOT_FOUND productId XA363636363633 requestDate 2020-07-24",

Need help to extract those productIDs (XA363636363633) which printed as REGISTER_NOT_FOUND in log

0 Karma
1 Solution

gkapitany
Explorer

search .. |rex field=_raw ".REGISTER_NOT_FOUND\s+productId\s+(?\w+)."

View solution in original post

0 Karma

gkapitany
Explorer

search .. |rex field=_raw ".REGISTER_NOT_FOUND\s+productId\s+(?\w+)."

0 Karma

harishnpandey
Explorer

Thank you very much . it worked with small modification as

search .. |rex field=_raw "REGISTER_NOT_FOUND\s+productId\s+(?\w+)"|stats count by regNumber

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...