Splunk Search

Help extracting alphanumeric string after matching pattern

harishnpandey
Explorer
{"line":"2019-10-05 03:58:11.627 ERROR [xxx-csscsc0sssscs-xxxx] 1 --- [nio-8080-exec-2] c.u.f.b.s.registryImpl  : \u003c\u003c\u003c registryImpl  : registerInformation(): caught NnaException REGISTER_NOT_FOUND productId XA363636363633 requestDate 2020-07-24",

Need help to extract those productIDs (XA363636363633) which printed as REGISTER_NOT_FOUND in log

0 Karma
1 Solution

gkapitany
Explorer

search .. |rex field=_raw ".REGISTER_NOT_FOUND\s+productId\s+(?\w+)."

View solution in original post

0 Karma

gkapitany
Explorer

search .. |rex field=_raw ".REGISTER_NOT_FOUND\s+productId\s+(?\w+)."

0 Karma

harishnpandey
Explorer

Thank you very much . it worked with small modification as

search .. |rex field=_raw "REGISTER_NOT_FOUND\s+productId\s+(?\w+)"|stats count by regNumber

0 Karma
Get Updates on the Splunk Community!

Manual Instrumentation with Splunk Observability Cloud: The What and Why

If you've ever worked with distributed systems, you’ve likely felt the pain of a frontend throwing errors, ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...