Hi,
I have this in my message string:
Errors in file /u02/app/oracle/diag/rdbms/pwein1a/pwein1a1/trace/pwein1a1_cjq0_287471.trc: ORA-12850: Could not allocate slaves on all specified instances: needed, allocated
ORA-16401: archive log rejected by Remote File Server (RFS)
I would like to extract in a search only the substring: ORA-nnnnn
Any ideas, I tried every solution available here in the community. Bu I am fairly new to Splunk.
Thanks Pierre
Hi, You can use rex command...
|makeresults | eval _raw="pwein1a1_cjq0_287471.trc: ORA-12850: Could not allocate" | rex field=_raw "(?<oraNum>ORA-\d+)\:" | table _raw oraNum
if this solves your query, pls accept this as solution, upvote is appreciated, thanks.
Hi, You can use rex command...
|makeresults | eval _raw="pwein1a1_cjq0_287471.trc: ORA-12850: Could not allocate" | rex field=_raw "(?<oraNum>ORA-\d+)\:" | table _raw oraNum
if this solves your query, pls accept this as solution, upvote is appreciated, thanks.
Thanks a lot !