Splunk Search

Help with regular expression

indianhans
Engager

I wish to extract any number between "cmdbRequest" & "- Transaction" . For Example from below string

ERROR 21 CMDB cmdbRequest 1089798797 - Transaction Null: 10/21/2015 07:25:34 - Exception: ORA-12578: TNS:wallet open failed

i wish to extract 1089798797

i have wrtten below regular expression to get the number, but its giving me a null value.

| rex "CMDBRequest(?P<Request_ID>.*?)Transaction" |

Can anyone please help ?

0 Karma

bevant
Explorer

won't you need to cater for the stuff either side (spaces/dashes?

rex "cmdbRequest\s(?<Request_ID>\d+)\s\-\sTransaction"

...or something like that, depending on how consistent you expect it to all be. I've not tested it, but it might put you on the correct path

0 Karma

abhijitmishra87
Explorer

Please try the following :

| rex "cmdbRequest(?P<Request_ID>\d+)Transaction" |
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...