The log is:
2015-06-15 15:50:29,381 ws prd 62 WARN JourneySearch # # # # Blocked Incoming Request 13360-PSA-LIS
I have used this for the 3/5 digit number, but I want know to extract the words after the number:
rex field=_raw " Blocked Incoming Request (?<aid>\d+)"
Can someone help me please?
You can also get the words as a multi-valued result and separate them as needed with mvexpand
|rex field=_raw "Request (?<aid>\d+)\-(?<words>\S+)" |makemv delim="-" words |mvexpand words