Splunk Search

How do I extract a substring beginning by some characters and ending by :

proussinbnc
Engager

Hi,

I have this in my message string:

Errors in file /u02/app/oracle/diag/rdbms/pwein1a/pwein1a1/trace/pwein1a1_cjq0_287471.trc: ORA-12850: Could not allocate slaves on all specified instances: needed, allocated

ORA-16401: archive log rejected by Remote File Server (RFS)

 

I would like to extract in a search only the substring: ORA-nnnnn

 

Any ideas, I tried every solution available here in the community. Bu I am fairly new to Splunk.

 

Thanks Pierre

Labels (1)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

Hi, You can use rex command...

|makeresults | eval _raw="pwein1a1_cjq0_287471.trc: ORA-12850: Could not allocate" | rex field=_raw "(?<oraNum>ORA-\d+)\:" | table _raw oraNum

oraNum.png

if this solves your query, pls accept this as solution, upvote is appreciated, thanks. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi, You can use rex command...

|makeresults | eval _raw="pwein1a1_cjq0_287471.trc: ORA-12850: Could not allocate" | rex field=_raw "(?<oraNum>ORA-\d+)\:" | table _raw oraNum

oraNum.png

if this solves your query, pls accept this as solution, upvote is appreciated, thanks. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

proussinbnc
Engager

Thanks a lot !

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...